CVE-2025-71360: picklescan scanner bypass enables

CISO Take

Picklescan, the scanner many ML teams and model hubs (including Hugging Face's own recommended workflow) rely on to vet pickle-serialized models before loading, fails to flag malicious payloads routed through idlelib.calltip.get_entity inside a pickle's __reduce__ method — letting a crafted file pass as 'clean' and then execute attacker-controlled code the moment it's unpickled. This is a CVSS 8.1 defense-evasion flaw rather than a garden-variety RCE: it defeats the exact control organizations deploy to catch pickle-based supply-chain attacks, so any pipeline that treats a picklescan-clean verdict as sufficient trust for a third-party model, checkpoint, or dataset is currently exposed. There is no EPSS score, no CISA KEV listing, no public exploit, and no Nuclei template, and exploitation requires user interaction (someone must load the file), so this reads as a disclosed research finding rather than an active campaign for now — but the bypass technique is trivial to replicate once public. Upgrade picklescan to 0.0.29 or later immediately, and stop treating scanner-clean results as a sole gate: prefer safetensors over pickle for model artifacts, sandbox/isolate model deserialization, and add detection rules that flag idlelib.calltip references inside scanned pickle opcodes.

Sources: NVD GitHub Advisory vulncheck.com ATLAS

What is the risk?

High risk despite the absence of active exploitation signals (no EPSS, no KEV, no public exploit or Nuclei template). The severity comes from what picklescan is used for: it is a trust boundary specifically built to make pickle deserialization safe in ML workflows. A bypass in the scanner itself has outsized blast radius because it silently defeats defense-in-depth for every downstream consumer that gates model/dataset ingestion on a 'scan passed' signal. Confidentiality and integrity impact are rated high (C:H/I:H) with no availability impact, consistent with arbitrary code execution on the host that loads the pickle. The only mitigating factor is required user interaction — an operator or automated pipeline still has to actually deserialize the crafted file.

How does the attack unfold?

Craft evasive payload

Attacker builds a malicious pickle file whose __reduce__ method calls idlelib.calltip.get_entity to smuggle a code-execution primitive past picklescan's detection logic.

AML.T0018.002

Distribute artifact

Attacker publishes the crafted file as a model checkpoint or dataset on a hub, repository, or via phishing to reach a victim's ML pipeline.

AML.T0011.001

Evade scanning gate

Victim's automated pipeline runs picklescan (<0.0.29), which returns a false 'safe' verdict, allowing the file through the trust gate.

AML.T0107

Code execution on load

Victim or automation calls pickle.load() on the file, triggering the reduce method and executing attacker-controlled remote commands on the host.

AML.T0011.000

Craft evasive payload

Attacker builds a malicious pickle file whose __reduce__ method calls idlelib.calltip.get_entity to smuggle a code-execution primitive past picklescan's detection logic.

AML.T0018.002

Distribute artifact

Attacker publishes the crafted file as a model checkpoint or dataset on a hub, repository, or via phishing to reach a victim's ML pipeline.

AML.T0011.001

Evade scanning gate

Victim's automated pipeline runs picklescan (<0.0.29), which returns a false 'safe' verdict, allowing the file through the trust gate.

AML.T0107

Code execution on load

Victim or automation calls pickle.load() on the file, triggering the reduce method and executing attacker-controlled remote commands on the host.

AML.T0011.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
picklescan	pip	—	No patch
418 3 dependents Pushed 25d ago 53% patched ~12d to patch Full package profile →

Do you use picklescan? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 23% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Advanced

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Unchanged

C High

I High

A None

What should I do?

1 step

1) Upgrade picklescan to >=0.0.29 immediately across all CI pipelines, model-hub ingestion services, and developer tooling. 2) Do not rely on picklescan (any version) as a sole control — migrate model serialization to safetensors or other non-executable formats wherever the framework supports it. 3) Sandbox or isolate any process that must deserialize untrusted pickle files (containerized, network-egress-restricted, non-privileged execution). 4) Use a restricted unpickler / allowlist-based Unpickler.find_class override as an additional layer even after upgrading the scanner. 5) Detection: audit historical scan logs and re-scan previously 'clean' artifacts with the patched picklescan version; add SIEM/EDR rules alerting on idlelib.calltip.get_entity references or unexpected idlelib imports appearing in files not related to IDLE usage.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Code Execution Model Framework AML.T0011.000 - Unsafe AI Artifacts AML.T0011.001 - Malicious Package AML.T0018.002 - Embed Malware AML.T0072 - Reverse Shell AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Annex A.6.2.3 - AI system security and resilience

NIST AI RMF

MANAGE 1.1 / MAP 3.1 - Third-party and supply chain risk management

OWASP LLM Top 10

LLM05:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2025-71360?

Picklescan, the scanner many ML teams and model hubs (including Hugging Face's own recommended workflow) rely on to vet pickle-serialized models before loading, fails to flag malicious payloads routed through idlelib.calltip.get_entity inside a pickle's __reduce__ method — letting a crafted file pass as 'clean' and then execute attacker-controlled code the moment it's unpickled. This is a CVSS 8.1 defense-evasion flaw rather than a garden-variety RCE: it defeats the exact control organizations deploy to catch pickle-based supply-chain attacks, so any pipeline that treats a picklescan-clean verdict as sufficient trust for a third-party model, checkpoint, or dataset is currently exposed. There is no EPSS score, no CISA KEV listing, no public exploit, and no Nuclei template, and exploitation requires user interaction (someone must load the file), so this reads as a disclosed research finding rather than an active campaign for now — but the bypass technique is trivial to replicate once public. Upgrade picklescan to 0.0.29 or later immediately, and stop treating scanner-clean results as a sole gate: prefer safetensors over pickle for model artifacts, sandbox/isolate model deserialization, and add detection rules that flag idlelib.calltip references inside scanned pickle opcodes.

Is CVE-2025-71360 actively exploited?

No confirmed active exploitation of CVE-2025-71360 has been reported, but organizations should still patch proactively.

How to fix CVE-2025-71360?

1) Upgrade picklescan to >=0.0.29 immediately across all CI pipelines, model-hub ingestion services, and developer tooling. 2) Do not rely on picklescan (any version) as a sole control — migrate model serialization to safetensors or other non-executable formats wherever the framework supports it. 3) Sandbox or isolate any process that must deserialize untrusted pickle files (containerized, network-egress-restricted, non-privileged execution). 4) Use a restricted unpickler / allowlist-based Unpickler.find_class override as an additional layer even after upgrading the scanner. 5) Detection: audit historical scan logs and re-scan previously 'clean' artifacts with the patched picklescan version; add SIEM/EDR rules alerting on idlelib.calltip.get_entity references or unexpected idlelib imports appearing in files not related to IDLE usage.

What systems are affected by CVE-2025-71360?

This vulnerability affects the following AI/ML architecture patterns: model serving, MLOps CI/CD pipelines, model registries/hubs, training pipelines.

What is the CVSS score for CVE-2025-71360?

CVE-2025-71360 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.30%.

What is the AI security impact?

Affected AI Architectures

model servingMLOps CI/CD pipelinesmodel registries/hubstraining pipelines

MITRE ATLAS Techniques

AML.T0011.000 Unsafe AI Artifacts

AML.T0011.001 Malicious Package

AML.T0018.002 Embed Malware

AML.T0072 Reverse Shell

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.6.2.3

NIST AI RMF: MANAGE 1.1 / MAP 3.1

OWASP LLM Top 10: LLM05:2025

What are the technical details?

Original Advisory

picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.calltip.get_entity function in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.

Exploitation Scenario

An attacker crafts a malicious pickle file — packaged as a 'model checkpoint' or dataset artifact — whose __reduce__ method invokes idlelib.calltip.get_entity as a smuggling primitive that picklescan's opcode/import allowlist does not recognize as dangerous. The attacker uploads the file to a public model hub, attaches it to a phishing email, or submits it to a CI pipeline that auto-scans incoming artifacts. The victim's automated gate runs picklescan, receives a 'safe' verdict, and proceeds to load the model with pickle.load() (directly or via a wrapping library), which triggers execution of attacker-supplied code — potentially opening a reverse shell or establishing persistence on the ML training/inference host.

Weaknesses (CWE)

CWE-502 Deserialization of Untrusted Data Primary CWE-502 Deserialization of Untrusted Data

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.