CVE-2025-71367: picklescan attrgetter bypass evades

CISO Take

picklescan, an open-source scanner many teams use as a pre-load safety gate for pickle-serialized ML models, fails to flag pickle payloads that use _operator.attrgetter inside a __reduce__ method, so a file that should be blocked is instead reported clean. This matters because the entire value of picklescan is trust delegation — teams download models from hubs or partners and rely on a passing scan to greenlight pickle.load(), so a detection gap here quietly reintroduces the exact arbitrary code execution risk pickle scanning exists to prevent (CVSS 8.1, no privileges required, network attack vector). Exploitation likelihood is currently modest — EPSS sits at 0.445% (top 64th percentile), there's no CISA KEV listing, and no public exploit or Nuclei template exists yet — but the flaw is trivial to weaponize once understood, since it only requires substituting one reduce-callable pattern for another. Upgrade picklescan to >=0.0.34 immediately in any CI/CD, model registry, or ingestion pipeline that gates pickle files on its output, and until upgraded, do not treat a picklescan 'safe' verdict as sufficient — prefer safetensors, sandbox any pickle.load() calls, and monitor for attrgetter-based opcodes as a compensating control.

Sources: NVD EPSS GitHub Advisory ATLAS vulncheck.com

What is the risk?

High severity by CVSS (8.1) due to unauthenticated network-vector code execution, but current real-world exploitation pressure is moderate-to-low: EPSS is 0.445% (64th percentile), there is no CISA KEV entry, no public PoC, and no scanner template exists. The real danger is structural rather than active — this is a bypass of a security control itself, so any environment that trusts a picklescan 'clean' result as a gate before pickle.load() inherits full RCE risk silently, without any alerting until an incident occurs. Requires user interaction (a victim or automated pipeline must actually execute pickle.load() on the crafted file after the scan clears it), which slightly raises the bar versus a fully automated remote attack but does not reduce impact once triggered.

How does the attack unfold?

Craft malicious artifact

Adversary builds a pickle file whose __reduce__ method uses _operator.attrgetter to construct a callable chain that avoids picklescan's known-bad patterns.

AML.T0018.002

Distribute as trusted model

The crafted file is published to a model hub or delivered directly as a legitimate-looking ML artifact.

AML.T0010.003

Evade security scan

The target's pipeline runs picklescan <0.0.34, which fails to detect the attrgetter-based reduce call and marks the file as safe.

AML.T0107

Execute and compromise host

The pipeline proceeds to pickle.load() the 'verified' file, triggering the reduce method and achieving arbitrary code execution on the host.

AML.T0011.000

Craft malicious artifact

Adversary builds a pickle file whose __reduce__ method uses _operator.attrgetter to construct a callable chain that avoids picklescan's known-bad patterns.

AML.T0018.002

Distribute as trusted model

The crafted file is published to a model hub or delivered directly as a legitimate-looking ML artifact.

AML.T0010.003

Evade security scan

The target's pipeline runs picklescan <0.0.34, which fails to detect the attrgetter-based reduce call and marks the file as safe.

AML.T0107

Execute and compromise host

The pipeline proceeds to pickle.load() the 'verified' file, triggering the reduce method and achieving arbitrary code execution on the host.

AML.T0011.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
picklescan	pip	—	No patch
418 3 dependents Pushed 25d ago 53% patched ~12d to patch Full package profile →

Do you use picklescan? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 37% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Unchanged

C High

I High

A None

What should I do?

1 step

Upgrade picklescan to version 0.0.34 or later immediately in all pipelines, CI/CD scanners, and model-hub ingestion tools that depend on it. Until upgraded, do not rely on picklescan as a sole control — add a compensating check for _operator.attrgetter (and other reduce-callable primitives) in pickle opcode streams, and prefer migrating model storage to safetensors or other non-executable serialization formats where possible. For pickle files that must still be loaded, isolate pickle.load() calls in a sandboxed/least-privilege process with no network or credential access, and log/alert on any pickle deserialization that invokes attrgetter, getattr, or operator module references as a detection signal.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Code Execution Model AML.T0010.003 - Model AML.T0011.000 - Unsafe AI Artifacts AML.T0018.002 - Embed Malware AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2.6 - Third-party and customer requirements / AI system supply chain security

NIST AI RMF

MANAGE 2.3 - Third-party AI resource risk management

OWASP LLM Top 10

LLM05 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2025-71367?

picklescan, an open-source scanner many teams use as a pre-load safety gate for pickle-serialized ML models, fails to flag pickle payloads that use _operator.attrgetter inside a __reduce__ method, so a file that should be blocked is instead reported clean. This matters because the entire value of picklescan is trust delegation — teams download models from hubs or partners and rely on a passing scan to greenlight pickle.load(), so a detection gap here quietly reintroduces the exact arbitrary code execution risk pickle scanning exists to prevent (CVSS 8.1, no privileges required, network attack vector). Exploitation likelihood is currently modest — EPSS sits at 0.445% (top 64th percentile), there's no CISA KEV listing, and no public exploit or Nuclei template exists yet — but the flaw is trivial to weaponize once understood, since it only requires substituting one reduce-callable pattern for another. Upgrade picklescan to >=0.0.34 immediately in any CI/CD, model registry, or ingestion pipeline that gates pickle files on its output, and until upgraded, do not treat a picklescan 'safe' verdict as sufficient — prefer safetensors, sandbox any pickle.load() calls, and monitor for attrgetter-based opcodes as a compensating control.

Is CVE-2025-71367 actively exploited?

No confirmed active exploitation of CVE-2025-71367 has been reported, but organizations should still patch proactively.

How to fix CVE-2025-71367?

Upgrade picklescan to version 0.0.34 or later immediately in all pipelines, CI/CD scanners, and model-hub ingestion tools that depend on it. Until upgraded, do not rely on picklescan as a sole control — add a compensating check for _operator.attrgetter (and other reduce-callable primitives) in pickle opcode streams, and prefer migrating model storage to safetensors or other non-executable serialization formats where possible. For pickle files that must still be loaded, isolate pickle.load() calls in a sandboxed/least-privilege process with no network or credential access, and log/alert on any pickle deserialization that invokes attrgetter, getattr, or operator module references as a detection signal.

What systems are affected by CVE-2025-71367?

This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines, MLOps CI/CD scanning, model registries/hubs.

What is the CVSS score for CVE-2025-71367?

CVE-2025-71367 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.45%.

What is the AI security impact?

Affected AI Architectures

model servingtraining pipelinesMLOps CI/CD scanningmodel registries/hubs

MITRE ATLAS Techniques

AML.T0010.003 Model

AML.T0011.000 Unsafe AI Artifacts

AML.T0018.002 Embed Malware

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM05

What are the technical details?

Original Advisory

picklescan before 0.0.34 fails to detect _operator.attrgetter function calls in pickle payloads, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle files using _operator.attrgetter in reduce methods to execute arbitrary code when pickle.load() processes the file.

Exploitation Scenario

An adversary crafts a malicious ML model file (e.g., a PyTorch checkpoint or joblib artifact) whose pickle stream uses a __reduce__ method built around _operator.attrgetter to reconstruct a callable chain — for example resolving os.system indirectly — rather than using the reduce patterns picklescan's blocklist already checks for. The adversary publishes or delivers this file as a seemingly legitimate model (via a public model hub, a pull request, or a shared artifact in a partner integration). The target's ingestion pipeline runs picklescan <0.0.34 as a pre-load safety gate, which reports the file as clean because it doesn't recognize the attrgetter-based reduce pattern. The victim's pipeline then proceeds to call pickle.load() on the 'verified' file, triggering the reconstructed callable and achieving arbitrary code execution inside the model-serving, training, or CI/CD host — potentially exposing secrets, training data, or lateral access to other pipeline stages.

Weaknesses (CWE)

CWE-502 Deserialization of Untrusted Data Primary CWE-502 Deserialization of Untrusted Data

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.