CVE-2025-71363: picklescan scanner bypass enables

CISO Take

picklescan is the de facto gatekeeper many ML teams and model hubs rely on to vet pickle-format model files before they're loaded, and this flaw shows it fails to flag a specific bypass technique: embedding a cProfile.run() call inside a pickle's __reduce__ method, which executes arbitrary code on deserialization but slips past picklescan's detection logic. The real danger here isn't the CVSS 8.1 score in isolation, it's that any pipeline treating a picklescan 'clean' verdict as a green light for pickle deserialization now has a documented blind spot, meaning a malicious model uploaded to a hub or internal registry could pass automated screening and still compromise whoever loads it. EPSS sits low (0.585%, ~56th percentile) and there's no public exploit, PoC, or Nuclei template yet, so this isn't an active-exploitation emergency, but pickle-based supply chain attacks against ML artifacts are a well-established technique class adversaries already use. Upgrade picklescan to 0.0.30 or later immediately in any CI/CD or model-ingestion pipeline that gates on it, and treat picklescan as a defense-in-depth layer rather than a sole control — prefer safetensors or other non-executable formats for model distribution wherever possible, and sandbox any pickle deserialization that can't be avoided.

Sources: NVD GitHub Advisory EPSS

What is the risk?

High-severity (CVSS 8.1) detection-bypass vulnerability in a security tool itself, which amplifies risk beyond a typical library bug because it undermines the assumed safety net of an automated scanning gate. Exploitability requires an attacker to craft a specific malicious pickle and get a victim to load it (user interaction required, no privileges needed), so it's not remotely triggerable without some form of social engineering or supply chain placement. No CISA KEV listing, no public exploit code, and a low-to-moderate EPSS score indicate exploitation is not currently widespread or trivial, but the technique is straightforward once documented (as this advisory now does) and pickle deserialization RCE is a mature, well-understood attack class in the ML ecosystem.

How does the attack unfold?

Craft evasive payload

Adversary builds a malicious pickle file with a cProfile.run() call inside a __reduce__ method, specifically engineered to slip past picklescan's detection logic.

AML.T0017.000

Distribute via model supply chain

The malicious pickle-format model file is uploaded to a public model hub, internal registry, or sent directly as a shared checkpoint.

AML.T0010.003

Evade automated scanning

picklescan (pre-0.0.30) scans the file and fails to flag the cProfile.run() call, marking the artifact as safe to load.

AML.T0011.000

Code execution on load

The victim's pipeline deserializes the 'verified' pickle file, triggering cProfile.run() and executing arbitrary attacker code with the privileges of the ML process.

AML.T0050

Craft evasive payload

Adversary builds a malicious pickle file with a cProfile.run() call inside a __reduce__ method, specifically engineered to slip past picklescan's detection logic.

AML.T0017.000

Distribute via model supply chain

The malicious pickle-format model file is uploaded to a public model hub, internal registry, or sent directly as a shared checkpoint.

AML.T0010.003

Evade automated scanning

picklescan (pre-0.0.30) scans the file and fails to flag the cProfile.run() call, marking the artifact as safe to load.

AML.T0011.000

Code execution on load

The victim's pipeline deserializes the 'verified' pickle file, triggering cProfile.run() and executing arbitrary attacker code with the privileges of the ML process.

AML.T0050

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
picklescan	pip	—	No patch
418 3 dependents Pushed 25d ago 53% patched ~12d to patch Full package profile →

Do you use picklescan? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 45% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Advanced

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Unchanged

C High

I High

A None

What should I do?

1 step

Upgrade picklescan to version 0.0.30 or later across all model-ingestion and CI/CD pipelines immediately. Do not treat a picklescan 'safe' verdict as sufficient on its own — layer additional controls such as loading models in a sandboxed/ephemeral environment, restricting network and filesystem access for the deserializing process, and migrating model storage to non-executable formats like safetensors wherever feasible. For detection, audit pickle files already accepted as 'clean' by pre-0.0.30 picklescan for cProfile.run() calls or other unusual reduce-method payloads, and monitor for anomalous process/network activity following model load events.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Code Execution Model Inference AML.T0010.003 - Model AML.T0011.000 - Unsafe AI Artifacts AML.T0018.002 - Embed Malware AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.3 - Third-party and supplier relationships

OWASP LLM Top 10

LLM05 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2025-71363?

picklescan is the de facto gatekeeper many ML teams and model hubs rely on to vet pickle-format model files before they're loaded, and this flaw shows it fails to flag a specific bypass technique: embedding a cProfile.run() call inside a pickle's __reduce__ method, which executes arbitrary code on deserialization but slips past picklescan's detection logic. The real danger here isn't the CVSS 8.1 score in isolation, it's that any pipeline treating a picklescan 'clean' verdict as a green light for pickle deserialization now has a documented blind spot, meaning a malicious model uploaded to a hub or internal registry could pass automated screening and still compromise whoever loads it. EPSS sits low (0.585%, ~56th percentile) and there's no public exploit, PoC, or Nuclei template yet, so this isn't an active-exploitation emergency, but pickle-based supply chain attacks against ML artifacts are a well-established technique class adversaries already use. Upgrade picklescan to 0.0.30 or later immediately in any CI/CD or model-ingestion pipeline that gates on it, and treat picklescan as a defense-in-depth layer rather than a sole control — prefer safetensors or other non-executable formats for model distribution wherever possible, and sandbox any pickle deserialization that can't be avoided.

Is CVE-2025-71363 actively exploited?

No confirmed active exploitation of CVE-2025-71363 has been reported, but organizations should still patch proactively.

How to fix CVE-2025-71363?

Upgrade picklescan to version 0.0.30 or later across all model-ingestion and CI/CD pipelines immediately. Do not treat a picklescan 'safe' verdict as sufficient on its own — layer additional controls such as loading models in a sandboxed/ephemeral environment, restricting network and filesystem access for the deserializing process, and migrating model storage to non-executable formats like safetensors wherever feasible. For detection, audit pickle files already accepted as 'clean' by pre-0.0.30 picklescan for cProfile.run() calls or other unusual reduce-method payloads, and monitor for anomalous process/network activity following model load events.

What systems are affected by CVE-2025-71363?

This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines, supply chain / model distribution, MLOps CI/CD.

What is the CVSS score for CVE-2025-71363?

CVE-2025-71363 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.58%.

What is the AI security impact?

Affected AI Architectures

model servingtraining pipelinessupply chain / model distributionMLOps CI/CD

MITRE ATLAS Techniques

AML.T0010.003 Model

AML.T0011.000 Unsafe AI Artifacts

AML.T0018.002 Embed Malware

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.3

OWASP LLM Top 10: LLM05

What are the technical details?

Original Advisory

picklescan before 0.0.30 fails to detect cProfile.run function calls in pickle reduce methods, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files with cProfile.run payloads that bypass picklescan detection and achieve code execution upon deserialization.

Exploitation Scenario

An adversary crafts a malicious ML model file serialized with pickle, embedding a cProfile.run() call inside a custom __reduce__ method that executes an attacker-controlled command string when the object is unpickled. The attacker uploads this file to a public model repository, a compromised internal artifact store, or sends it directly to a target as a 'shared model checkpoint.' The victim organization's pipeline runs picklescan as an automated safety check before loading, and because picklescan (pre-0.0.30) doesn't recognize cProfile.run() as a dangerous call, the file is marked safe. A data scientist or automated training/inference job then loads the file via pickle.load() or torch.load(), triggering the embedded cProfile.run() payload and granting the attacker code execution on the host running the ML workload.

Weaknesses (CWE)

CWE-502 Deserialization of Untrusted Data Primary CWE-502 Deserialization of Untrusted Data

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.