CVE-2025-71366: picklescan: scan bypass lets malicious pickle RCE

picklescan, one of the de-facto scanners used to vet pickle-format ML model files before they are loaded, fails to flag a specific malicious pattern — a pickle file that calls torch.utils.bottleneck.__main__.run_cprofile — meaning a crafted model artifact sails through the safety check and still achieves arbitrary code execution the moment someone deserializes it with pickle.load or torch.load. This matters less because of raw severity (CVSS 8.1, no privileges needed) and more because it undermines a trust control: any pipeline, model hub mirror, or CI job that treats a picklescan 'clean' verdict as sufficient proof a model artifact is safe is currently wrong for this specific gadget. There is no CISA KEV listing, no published EPSS score, and no public exploit code or Nuclei template as of this writing, so this is not an actively-exploited or scanner-automatable threat today — but the low complexity of the bypass (a single well-known torch function) means a working payload is trivial to reproduce once attackers notice this advisory. Action: upgrade picklescan to >=0.0.28 everywhere it gates model ingestion (CI, model registries, Hugging Face mirrors, internal MLOps pipelines), and until upgraded, do not treat a picklescan pass as sufficient — prefer safetensors or other non-pickle serialization for any model artifact of unknown provenance, and alert on any pickle deserialization event that imports torch.utils.bottleneck.__main__.run_cprofile.

No confirmed active exploitation of CVE-2025-71366 has been reported, but organizations should still patch proactively.

1) Upgrade picklescan to version 0.0.28 or later in every pipeline stage where it acts as a gate (CI, model registry ingestion, pre-deployment scanning). 2) Until upgraded, do not treat a 'safe' picklescan verdict as authoritative for untrusted or externally-sourced pickle files — add a second control such as running the scan plus sandboxed/ephemeral deserialization, or migrating to safetensors for model weights where feasible. 3) Detection: monitor/alert on deserialization events or process telemetry showing torch.utils.bottleneck.__main__.run_cprofile being invoked outside of legitimate profiling workflows. 4) Audit existing model artifact stores for pickle files that were previously cleared by picklescan <0.0.28 and re-scan them with the patched version. 5) Where possible, enforce a policy preferring non-pickle serialization formats for any model sourced from outside the organization.

This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines, MLOps / model registry ingestion, CI/CD model artifact scanning.

CVE-2025-71366 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.45%.