CVE-2025-71364: picklescan scanner blind spot enables

CISO Take

picklescan is the de-facto scanner many teams and model hubs rely on to vet pickle-serialized model files before loading them, and versions before 0.0.30 fail to flag pickle reduce calls to asyncio.unix_events._UnixSubprocessTransport._start — a builtin an attacker can use to spawn arbitrary subprocesses. That means a malicious model checkpoint can pass a picklescan "clean" verdict and still achieve remote code execution the moment someone loads it with pickle.load, torch.load, or a similar deserializer. There's no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template yet, so this looks like a disclosed research finding rather than active mass exploitation — but the attack requires only that a victim be lured into loading a file (UI:R), with no authentication and low complexity otherwise (CVSS 8.1, AV:N/AC:L/PR:N). The core concern for CISOs is trust: any pipeline, model registry, or approval gate that treats a picklescan "pass" as a security control needs to know that control has a documented false-negative. Patch to picklescan >=0.0.30 immediately, re-scan any previously "approved" pickle artifacts, and treat pickle scanning as one layer of defense rather than a hard trust boundary going forward.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

High severity (CVSS 8.1) but currently theoretical risk in terms of active exploitation — no KEV entry, no EPSS data, no public PoC or scanner signature exist yet. The real risk driver is scope: picklescan is purpose-built AI security tooling used to gate untrusted pickle files (a category ML teams already treat as dangerous), so a detection bypass undermines a control organizations may be relying on as their primary defense against exactly this class of attack. Because exploitation requires a victim to load a crafted file (user interaction required), this is not remotely wormable, but it is trivially social-engineerable in ML workflows where model files are routinely downloaded from external sources (Hugging Face, GitHub releases, shared drives) and loaded with minimal scrutiny once a scanner has cleared them.

How does the attack unfold?

Craft malicious artifact

Attacker builds a pickle file whose __reduce__ method calls asyncio.unix_events._UnixSubprocessTransport._start to spawn an arbitrary command.

AML.T0011.000

Evade detection

The artifact passes picklescan (versions before 0.0.30) as clean because this specific builtin isn't in its detection rules.

AML.T0074

Victim loads artifact

A data scientist or automated pipeline, trusting the scan result, loads the file via pickle.load/torch.load.

AML.T0011

Remote code execution

Deserialization triggers the reduce call, spawning a subprocess and giving the attacker command execution on the host.

AML.T0050

Craft malicious artifact

Attacker builds a pickle file whose __reduce__ method calls asyncio.unix_events._UnixSubprocessTransport._start to spawn an arbitrary command.

AML.T0011.000

Evade detection

The artifact passes picklescan (versions before 0.0.30) as clean because this specific builtin isn't in its detection rules.

AML.T0074

Victim loads artifact

A data scientist or automated pipeline, trusting the scan result, loads the file via pickle.load/torch.load.

AML.T0011

Remote code execution

Deserialization triggers the reduce call, spawning a subprocess and giving the attacker command execution on the host.

AML.T0050

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
picklescan	pip	—	No patch
418 3 dependents Pushed 25d ago 53% patched ~12d to patch Full package profile →

Do you use picklescan? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 44% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Unchanged

C High

I High

A None

What should I do?

1 step

Upgrade picklescan to >=0.0.30 across every host, CI job, and library dependency that invokes it, and re-scan any pickle files that were previously approved under an older version. Do not treat a picklescan pass as sufficient assurance on its own — layer in sandboxed or ephemeral environments for loading untrusted model files, restrict network egress from model-loading hosts, and prefer non-pickle formats (safetensors, ONNX) for any model that doesn't require arbitrary Python object deserialization. For detection, monitor for unexpected subprocess spawns or asyncio subprocess transport activity originating from ML training/inference/notebook processes, since that's the concrete behavior this bypass enables.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Code Execution Model Framework AML.T0010.001 - AI Software AML.T0011.000 - Unsafe AI Artifacts AML.T0018.002 - Embed Malware AML.T0074 - Masquerading

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.3 - AI system verification and validation processes

NIST AI RMF

MAP-5.1 - Likelihood and magnitude of impacts from third-party AI resources are assessed

OWASP LLM Top 10

LLM03:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2025-71364?

picklescan is the de-facto scanner many teams and model hubs rely on to vet pickle-serialized model files before loading them, and versions before 0.0.30 fail to flag pickle reduce calls to asyncio.unix_events._UnixSubprocessTransport._start — a builtin an attacker can use to spawn arbitrary subprocesses. That means a malicious model checkpoint can pass a picklescan "clean" verdict and still achieve remote code execution the moment someone loads it with pickle.load, torch.load, or a similar deserializer. There's no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template yet, so this looks like a disclosed research finding rather than active mass exploitation — but the attack requires only that a victim be lured into loading a file (UI:R), with no authentication and low complexity otherwise (CVSS 8.1, AV:N/AC:L/PR:N). The core concern for CISOs is trust: any pipeline, model registry, or approval gate that treats a picklescan "pass" as a security control needs to know that control has a documented false-negative. Patch to picklescan >=0.0.30 immediately, re-scan any previously "approved" pickle artifacts, and treat pickle scanning as one layer of defense rather than a hard trust boundary going forward.

Is CVE-2025-71364 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-71364, increasing the risk of exploitation.

How to fix CVE-2025-71364?

Upgrade picklescan to >=0.0.30 across every host, CI job, and library dependency that invokes it, and re-scan any pickle files that were previously approved under an older version. Do not treat a picklescan pass as sufficient assurance on its own — layer in sandboxed or ephemeral environments for loading untrusted model files, restrict network egress from model-loading hosts, and prefer non-pickle formats (safetensors, ONNX) for any model that doesn't require arbitrary Python object deserialization. For detection, monitor for unexpected subprocess spawns or asyncio subprocess transport activity originating from ML training/inference/notebook processes, since that's the concrete behavior this bypass enables.

What systems are affected by CVE-2025-71364?

This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines, AI/ML supply chain security tooling.

What is the CVSS score for CVE-2025-71364?

CVE-2025-71364 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.56%.

What is the AI security impact?

Affected AI Architectures

model servingtraining pipelinesAI/ML supply chain security tooling

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0011.000 Unsafe AI Artifacts

AML.T0018.002 Embed Malware

AML.T0074 Masquerading

Compliance Controls Affected

ISO 42001: A.6.2.3

NIST AI RMF: MAP-5.1

OWASP LLM Top 10: LLM03:2025

What are the technical details?

Original Advisory

picklescan before 0.0.30 fails to detect the asyncio.unix_events._UnixSubprocessTransport._start function in pickle reduce methods, allowing remote code execution. Attackers can craft malicious pickle files embedding this built-in function that evade detection but execute arbitrary commands when loaded.

Exploitation Scenario

An attacker uploads a trojanized model checkpoint to a public model hub or sends it directly to a target, embedding a pickle __reduce__ call to asyncio.unix_events._UnixSubprocessTransport._start configured to launch a reverse shell or download-and-execute command. The victim's ML pipeline runs picklescan as a pre-load safety check, which returns a clean result because this specific builtin isn't on its detection list. The data scientist or automated pipeline, trusting the scan result, loads the file with torch.load or pickle.load, triggering the reduce method and spawning the attacker's subprocess with the privileges of the loading process — potentially inside a training cluster, CI runner, or inference host with access to other credentials and artifacts.

Weaknesses (CWE)

CWE-502 Deserialization of Untrusted Data Primary CWE-502 Deserialization of Untrusted Data

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.