CVE-2025-71359: picklescan scan bypass lets malicious

CISO Take

picklescan is the de facto safety gate that scans pickled ML model files for malicious code before they're loaded, and versions before 0.0.29 fail to flag payloads that abuse lib2to3.pgen2.grammar.Grammar.loads inside a pickle REDUCE opcode, letting a booby-trapped model file sail through as 'safe' and execute arbitrary code the moment pickle.load() runs. This isn't a bug in some obscure library — it's a bypass of the specific control that Hugging Face Hub and many internal MLOps pipelines rely on to vet third-party models, so a false 'clean' verdict here directly undermines model supply-chain trust, even though CVSS is 8.1 (network vector, no privileges, but requires a user or pipeline to actually load the file). EPSS sits at 0.43% (top 66th percentile) with no CISA KEV listing and no public exploit or Nuclei template yet, so this hasn't been weaponized at scale, but the technique is trivial to reproduce once known and the blast radius is anyone who trusts a picklescan 'PASS' as a security decision. Upgrade picklescan to >=0.0.29 immediately, and treat any model-scanning result from before that version as unverified; where feasible, require safetensors instead of pickle-based model formats and add a secondary check (e.g., fickling) rather than relying on a single scanner.

Sources: NVD EPSS GitHub Advisory vulncheck.com ATLAS

What is the risk?

High impact (full RCE, confidentiality and integrity both rated High) but currently low observed exploitation likelihood — EPSS 0.43%, not in CISA KEV, no public PoC or scanner signature found. The real risk driver is scope, not current activity: picklescan is a trust anchor used across the ML supply chain (model hubs, MLOps pipelines, CI ingestion of third-party models), so a bypass silently converts a security control into a false sense of safety. Exploitation requires user/pipeline interaction (someone or something must load the crafted model), which caps automated worm-style spread but fits neatly into typical 'download and evaluate a model' workflows. Organizations that gate model ingestion solely on picklescan output are at meaningfully higher risk than the raw CVSS/EPSS numbers suggest.

How does the attack unfold?

Craft evasive payload

Adversary builds a pickle file with a REDUCE opcode invoking lib2to3.pgen2.grammar.Grammar.loads, a call path not recognized by picklescan's dangerous-function detection.

AML.T0018.002

Distribute as model artifact

The malicious pickle is packaged as or embedded in a model checkpoint and published to a model hub or sent directly to a target pipeline.

AML.T0011.000

False-negative security scan

picklescan (pre-0.0.29) scans the file and reports it as safe, giving the victim's pipeline a false green light.

Deserialization RCE

The victim's system calls pickle.load() on the 'cleared' file, triggering the gadget chain and executing attacker code on the host.

AML.T0011

Craft evasive payload

Adversary builds a pickle file with a REDUCE opcode invoking lib2to3.pgen2.grammar.Grammar.loads, a call path not recognized by picklescan's dangerous-function detection.

AML.T0018.002

Distribute as model artifact

The malicious pickle is packaged as or embedded in a model checkpoint and published to a model hub or sent directly to a target pipeline.

AML.T0011.000

False-negative security scan

picklescan (pre-0.0.29) scans the file and reports it as safe, giving the victim's pipeline a false green light.

Deserialization RCE

The victim's system calls pickle.load() on the 'cleared' file, triggering the gadget chain and executing attacker code on the host.

AML.T0011

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
picklescan	pip	—	No patch
418 3 dependents Pushed 25d ago 53% patched ~12d to patch Full package profile →

Do you use picklescan? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 36% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Advanced

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Unchanged

C High

I High

A None

What should I do?

1 step

1) Upgrade picklescan to >=0.0.29 across all scanning services, CI jobs, and developer tooling immediately — treat this as a patch-now item given the RCE impact. 2) Re-scan or re-vet any model files that were previously cleared by a pre-0.0.29 picklescan, especially those sourced from public model hubs. 3) Where possible, migrate model storage/exchange to safetensors or other non-executable serialization formats instead of pickle. 4) Do not rely on a single scanner as the sole gate — layer in a second detection tool (e.g., fickling) and/or sandbox model loading (unprivileged container, no network egress, seccomp) as defense in depth. 5) Add detection for anomalous pickle opcodes referencing unexpected stdlib modules (like lib2to3.pgen2.grammar) in ingestion logging, since legitimate models have no reason to invoke that code path.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Supply Chain Model Framework AML.T0010.003 - Model AML.T0011 - User Execution AML.T0011.000 - Unsafe AI Artifacts AML.T0018.002 - Embed Malware

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.10 - Third-party and supplier relationships for AI systems

NIST AI RMF

GOVERN 6.1 - AI supply chain risk understanding and management

OWASP LLM Top 10

LLM05:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2025-71359?

picklescan is the de facto safety gate that scans pickled ML model files for malicious code before they're loaded, and versions before 0.0.29 fail to flag payloads that abuse lib2to3.pgen2.grammar.Grammar.loads inside a pickle REDUCE opcode, letting a booby-trapped model file sail through as 'safe' and execute arbitrary code the moment pickle.load() runs. This isn't a bug in some obscure library — it's a bypass of the specific control that Hugging Face Hub and many internal MLOps pipelines rely on to vet third-party models, so a false 'clean' verdict here directly undermines model supply-chain trust, even though CVSS is 8.1 (network vector, no privileges, but requires a user or pipeline to actually load the file). EPSS sits at 0.43% (top 66th percentile) with no CISA KEV listing and no public exploit or Nuclei template yet, so this hasn't been weaponized at scale, but the technique is trivial to reproduce once known and the blast radius is anyone who trusts a picklescan 'PASS' as a security decision. Upgrade picklescan to >=0.0.29 immediately, and treat any model-scanning result from before that version as unverified; where feasible, require safetensors instead of pickle-based model formats and add a secondary check (e.g., fickling) rather than relying on a single scanner.

Is CVE-2025-71359 actively exploited?

No confirmed active exploitation of CVE-2025-71359 has been reported, but organizations should still patch proactively.

How to fix CVE-2025-71359?

1) Upgrade picklescan to >=0.0.29 across all scanning services, CI jobs, and developer tooling immediately — treat this as a patch-now item given the RCE impact. 2) Re-scan or re-vet any model files that were previously cleared by a pre-0.0.29 picklescan, especially those sourced from public model hubs. 3) Where possible, migrate model storage/exchange to safetensors or other non-executable serialization formats instead of pickle. 4) Do not rely on a single scanner as the sole gate — layer in a second detection tool (e.g., fickling) and/or sandbox model loading (unprivileged container, no network egress, seccomp) as defense in depth. 5) Add detection for anomalous pickle opcodes referencing unexpected stdlib modules (like lib2to3.pgen2.grammar) in ingestion logging, since legitimate models have no reason to invoke that code path.

What systems are affected by CVE-2025-71359?

This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines, MLOps model registries, CI/CD model ingestion pipelines.

What is the CVSS score for CVE-2025-71359?

CVE-2025-71359 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.43%.

What is the AI security impact?

Affected AI Architectures

model servingtraining pipelinesMLOps model registriesCI/CD model ingestion pipelines

MITRE ATLAS Techniques

AML.T0010.003 Model

AML.T0011 User Execution

AML.T0011.000 Unsafe AI Artifacts

AML.T0018.002 Embed Malware

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.10

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM05:2025

What are the technical details?

Original Advisory

picklescan before 0.0.29 fails to detect malicious pickle payloads that utilize lib2to3.pgen2.grammar.Grammar.loads in the reduce method, allowing remote code execution. Attackers can craft pickle files embedding dangerous code that evades picklescan detection and executes during pickle.load() deserialization.

Exploitation Scenario

An adversary crafts a malicious pickle-based model file (e.g., a .pkl or .bin checkpoint) embedding a REDUCE opcode that calls lib2to3.pgen2.grammar.Grammar.loads with attacker-controlled arguments designed to trigger code execution on deserialization. They upload the file to a public model repository or send it directly to a target, relying on the fact that picklescan's dangerous-function blocklist doesn't recognize this call path and reports the file as safe. A victim's MLOps pipeline or data scientist, trusting the picklescan 'clean' result, downloads the model and loads it with pickle.load() (directly or via a framework wrapper), at which point the embedded gadget executes with the privileges of the loading process — potentially a CI runner, training server, or inference host.

Weaknesses (CWE)

CWE-502 Deserialization of Untrusted Data Primary CWE-502 Deserialization of Untrusted Data

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.