CVE-2025-71362: picklescan scanner bypass enables RCE

CISO Take

picklescan is the security scanner many ML teams bolt onto their pipelines specifically to catch malicious pickle files before they're deserialized, and this flaw lets a crafted pickle slip past that scanner entirely by routing through numpy.f2py.crackfortran functions that call Python's eval() on attacker-controlled strings, resulting in arbitrary code execution the moment the file is loaded. This matters because it doesn't just add a new attack path — it defeats the specific control teams rely on to catch exactly this class of attack, so a pipeline that gates model ingestion on a 'picklescan clean' result is silently exposed even after passing its security check. There's no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, but the CVSS 8.1 (network vector, low complexity, no privileges required, only user interaction to trigger) means a single poisoned model uploaded to a shared hub or internal registry is enough once someone loads it. Upgrade picklescan to 0.0.33 or later immediately, and until every dependent pipeline has picked up the patch, treat a picklescan 'safe' verdict on untrusted pickle files as unverified — pair it with sandboxed loading, restricted unpicklers, or migration to safetensors for anything sourced externally.

Sources: NVD GitHub Advisory vulncheck.com ATLAS

What is the risk?

High risk despite the absence of known active exploitation: the flaw undermines a purpose-built security control (picklescan) rather than a general-purpose library, meaning organizations that believe they've mitigated pickle deserialization risk are still exposed. CVSS 8.1 reflects a network-reachable, low-complexity path with no privileges required — the only gate is a user (or automated pipeline) loading the file, which is the routine, expected behavior for any ML model-loading workflow. No EPSS percentile, KEV listing, or public exploit exists yet, so opportunistic mass exploitation is unlikely today, but the trivial nature of embedding a malicious reduce call once the bypass technique is public raises the exploitation ceiling quickly.

How does the attack unfold?

Stage malicious artifact

Attacker crafts a pickle file whose __reduce__ invokes a numpy.f2py.crackfortran function that calls eval() on an embedded malicious string, then publishes it to a model hub or shared registry.

AML.T0018.002

Evade security scan

The victim's pipeline runs picklescan as a pre-load gate; the tool fails to flag the crackfortran eval path and returns a clean/safe verdict.

AML.T0010.001

Trigger execution

The model file is deserialized in a training, inference, or CI environment (e.g., via torch.load), invoking the crackfortran function and executing the attacker's code.

AML.T0011.000

Post-exploitation impact

The attacker gains code execution inside the ML environment, enabling credential theft, lateral movement, or further poisoning of downstream models and pipelines.

AML.T0025

Stage malicious artifact

Attacker crafts a pickle file whose __reduce__ invokes a numpy.f2py.crackfortran function that calls eval() on an embedded malicious string, then publishes it to a model hub or shared registry.

AML.T0018.002

Evade security scan

The victim's pipeline runs picklescan as a pre-load gate; the tool fails to flag the crackfortran eval path and returns a clean/safe verdict.

AML.T0010.001

Trigger execution

The model file is deserialized in a training, inference, or CI environment (e.g., via torch.load), invoking the crackfortran function and executing the attacker's code.

AML.T0011.000

Post-exploitation impact

The attacker gains code execution inside the ML environment, enabling credential theft, lateral movement, or further poisoning of downstream models and pipelines.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
picklescan	pip	—	No patch
418 3 dependents Pushed 25d ago 53% patched ~12d to patch Full package profile →

Do you use picklescan? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 23% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Unchanged

C High

I High

A None

What should I do?

1 step

Upgrade picklescan to version 0.0.33 or later immediately across all CI/CD pipelines, MLOps tooling, and internal scanning services. Do not treat a picklescan pass alone as sufficient assurance for untrusted pickle files — combine it with sandboxed/isolated loading (containers with no network/filesystem access), restricted custom unpicklers with strict class allowlists, or migrate model storage/exchange to safetensors, which has no code-execution surface. Audit recent model ingestion logs for any pickle files that passed a pre-0.0.33 picklescan and were subsequently loaded, and re-scan them with the patched version. Add detection rules for anomalous eval()/exec() calls or unexpected f2py module imports in ML runtime environments as a compensating control.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Code Execution Model Framework AML.T0010.001 - AI Software AML.T0011.000 - Unsafe AI Artifacts AML.T0018.002 - Embed Malware AML.T0050 - Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MANAGE 4.1 - Post-deployment monitoring for third-party AI risks

OWASP LLM Top 10

LLM05:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2025-71362?

picklescan is the security scanner many ML teams bolt onto their pipelines specifically to catch malicious pickle files before they're deserialized, and this flaw lets a crafted pickle slip past that scanner entirely by routing through numpy.f2py.crackfortran functions that call Python's eval() on attacker-controlled strings, resulting in arbitrary code execution the moment the file is loaded. This matters because it doesn't just add a new attack path — it defeats the specific control teams rely on to catch exactly this class of attack, so a pipeline that gates model ingestion on a 'picklescan clean' result is silently exposed even after passing its security check. There's no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, but the CVSS 8.1 (network vector, low complexity, no privileges required, only user interaction to trigger) means a single poisoned model uploaded to a shared hub or internal registry is enough once someone loads it. Upgrade picklescan to 0.0.33 or later immediately, and until every dependent pipeline has picked up the patch, treat a picklescan 'safe' verdict on untrusted pickle files as unverified — pair it with sandboxed loading, restricted unpicklers, or migration to safetensors for anything sourced externally.

Is CVE-2025-71362 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-71362, increasing the risk of exploitation.

How to fix CVE-2025-71362?

Upgrade picklescan to version 0.0.33 or later immediately across all CI/CD pipelines, MLOps tooling, and internal scanning services. Do not treat a picklescan pass alone as sufficient assurance for untrusted pickle files — combine it with sandboxed/isolated loading (containers with no network/filesystem access), restricted custom unpicklers with strict class allowlists, or migrate model storage/exchange to safetensors, which has no code-execution surface. Audit recent model ingestion logs for any pickle files that passed a pre-0.0.33 picklescan and were subsequently loaded, and re-scan them with the patched version. Add detection rules for anomalous eval()/exec() calls or unexpected f2py module imports in ML runtime environments as a compensating control.

What systems are affected by CVE-2025-71362?

This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines, agent frameworks.

What is the CVSS score for CVE-2025-71362?

CVE-2025-71362 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.30%.

What is the AI security impact?

Affected AI Architectures

model servingtraining pipelinesagent frameworks

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0011.000 Unsafe AI Artifacts

AML.T0018.002 Embed Malware

AML.T0050 Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MANAGE 4.1

OWASP LLM Top 10: LLM05:2025

What are the technical details?

Original Advisory

picklescan before 0.0.33 fails to detect unsafe deserialization when numpy.f2py.crackfortran functions call eval on arbitrary strings. Attackers can embed malicious code in pickle files that executes when loaded from untrusted sources.

Exploitation Scenario

An attacker uploads a poisoned model checkpoint to a public model hub or compromises an internal artifact store, embedding a pickle whose __reduce__ method invokes a numpy.f2py.crackfortran function with an attacker-controlled string. A security-conscious ML engineer runs picklescan as part of a pre-deployment CI gate, gets a clean/safe result because the scanner doesn't recognize this code path, and proceeds to load the model via torch.load or joblib.load in a training or inference environment. At load time, the crackfortran function calls eval() on the embedded string, executing arbitrary attacker code inside the ML pipeline — enabling credential theft, lateral movement, or further supply-chain poisoning of downstream artifacts.

Weaknesses (CWE)

CWE-502 Deserialization of Untrusted Data Primary CWE-502 Deserialization of Untrusted Data

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.