CVE-2025-71368: picklescan scan bypass lets malicious

CISO Take

picklescan is the de-facto scanner many ML teams run before deserializing untrusted pickle files, and versions before 0.0.30 fail to flag payloads that call doctest.debug_script, letting a crafted pickle sail through as "clean" and execute arbitrary code the moment pickle.load() runs. This matters more than a typical 8.1 CVSS because it's not a hole in some random library — it's a hole in the control teams specifically deployed to stop pickle-based supply-chain attacks, so anyone gating model ingestion or CI artifact loading on picklescan has a false sense of safety. Exploitation signals are currently modest (EPSS 0.77%, top 49th percentile; not in CISA KEV; no public exploit or Nuclei template yet), so this reads as a targeted supply-chain risk rather than mass exploitation today. Upgrade picklescan to >=0.0.30 immediately across any pipeline that ingests third-party pickle files, and stop treating picklescan as a sole gate — pair it with sandboxed deserialization and push teams toward safetensors/ONNX for model distribution wherever pickle isn't strictly required.

Sources: NVD GitHub Advisory EPSS ATLAS

What is the risk?

Base CVSS 8.1 (network, low complexity, no privileges, but requires user interaction to trigger pickle.load) understates the practical risk for organizations that adopted picklescan specifically as a pickle-deserialization safety net — the bypass removes exactly the protection they relied on, creating a false-negative blind spot in model/artifact ingestion pipelines. Near-term mass-exploitation likelihood is low (EPSS 0.77%, not in CISA KEV, no public PoC or scanner template found), so this looks more like a precision supply-chain vector against ML model registries and CI ingestion than an opportunistic internet-wide campaign. Risk rises sharply for any organization that accepts third-party pickle-format models (e.g., from public hubs) and relies on picklescan as the only pre-load control.

How does the attack unfold?

Craft malicious artifact

Attacker builds a pickle file embedding a doctest.debug_script call disguised as a normal model/data object.

AML.T0011.000

Publish and evade scanning

The file is uploaded to a model hub or supply-chain source and passes picklescan's pre-load check due to the detection gap.

AML.T0107

Deserialization execution

Victim pipeline calls pickle.load() on the 'clean' file, triggering doctest.debug_script and executing attacker-controlled commands.

AML.T0050

Impact

Attacker gains code execution on the training/CI/inference host, enabling data exfiltration, lateral movement, or downstream model poisoning.

AML.T0112

Craft malicious artifact

Attacker builds a pickle file embedding a doctest.debug_script call disguised as a normal model/data object.

AML.T0011.000

Publish and evade scanning

The file is uploaded to a model hub or supply-chain source and passes picklescan's pre-load check due to the detection gap.

AML.T0107

Deserialization execution

Victim pipeline calls pickle.load() on the 'clean' file, triggering doctest.debug_script and executing attacker-controlled commands.

AML.T0050

Impact

Attacker gains code execution on the training/CI/inference host, enabling data exfiltration, lateral movement, or downstream model poisoning.

AML.T0112

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
picklescan	pip	—	No patch
418 3 dependents Pushed 25d ago 53% patched ~12d to patch Full package profile →

Do you use picklescan? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.8%

chance of exploitation in 30 days

Higher than 53% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Unchanged

C High

I High

A None

What should I do?

1 step

Upgrade picklescan to >=0.0.30 immediately in every pipeline that scans pickle files pre-load. Until upgraded, do not treat a clean picklescan result as sufficient: isolate pickle.load() calls in a sandboxed/minimal-privilege environment (container with reduced capabilities, seccomp, no network egress) regardless of scan result. Prefer safetensors or ONNX over pickle for any model distributed or consumed from outside a fully trusted source. For detection, independently inspect pickle opcodes for GLOBAL imports of the doctest module (and other scanner-evasion patterns) rather than relying solely on picklescan's allow/deny verdict, and audit CI/registry logs for pickle uploads scanned by pre-0.0.30 picklescan versions that may have already passed malicious files.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Code Execution Model AML.T0011.000 - Unsafe AI Artifacts AML.T0018.002 - Embed Malware AML.T0050 - Command and Scripting Interpreter AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2 - Data and artifacts for AI systems

NIST AI RMF

MEASURE 2.7 - AI system security and resilience evaluated

OWASP LLM Top 10

LLM05:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2025-71368?

picklescan is the de-facto scanner many ML teams run before deserializing untrusted pickle files, and versions before 0.0.30 fail to flag payloads that call doctest.debug_script, letting a crafted pickle sail through as "clean" and execute arbitrary code the moment pickle.load() runs. This matters more than a typical 8.1 CVSS because it's not a hole in some random library — it's a hole in the control teams specifically deployed to stop pickle-based supply-chain attacks, so anyone gating model ingestion or CI artifact loading on picklescan has a false sense of safety. Exploitation signals are currently modest (EPSS 0.77%, top 49th percentile; not in CISA KEV; no public exploit or Nuclei template yet), so this reads as a targeted supply-chain risk rather than mass exploitation today. Upgrade picklescan to >=0.0.30 immediately across any pipeline that ingests third-party pickle files, and stop treating picklescan as a sole gate — pair it with sandboxed deserialization and push teams toward safetensors/ONNX for model distribution wherever pickle isn't strictly required.

Is CVE-2025-71368 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-71368, increasing the risk of exploitation.

How to fix CVE-2025-71368?

Upgrade picklescan to >=0.0.30 immediately in every pipeline that scans pickle files pre-load. Until upgraded, do not treat a clean picklescan result as sufficient: isolate pickle.load() calls in a sandboxed/minimal-privilege environment (container with reduced capabilities, seccomp, no network egress) regardless of scan result. Prefer safetensors or ONNX over pickle for any model distributed or consumed from outside a fully trusted source. For detection, independently inspect pickle opcodes for GLOBAL imports of the doctest module (and other scanner-evasion patterns) rather than relying solely on picklescan's allow/deny verdict, and audit CI/registry logs for pickle uploads scanned by pre-0.0.30 picklescan versions that may have already passed malicious files.

What systems are affected by CVE-2025-71368?

This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines, supply chain / model registries, CI/CD ingestion pipelines.

What is the CVSS score for CVE-2025-71368?

CVE-2025-71368 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.77%.

What is the AI security impact?

Affected AI Architectures

model servingtraining pipelinessupply chain / model registriesCI/CD ingestion pipelines

MITRE ATLAS Techniques

AML.T0011.000 Unsafe AI Artifacts

AML.T0018.002 Embed Malware

AML.T0050 Command and Scripting Interpreter

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

ISO 42001: A.6.2

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM05:2025

What are the technical details?

Original Advisory

picklescan before 0.0.30 fails to detect the doctest.debug_script function when analyzing pickle files, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files embedding doctest.debug_script calls that bypass picklescan detection and execute arbitrary commands upon pickle.load invocation.

Exploitation Scenario

An attacker crafts a pickle-serialized "pretrained model" or dataset artifact embedding a call to doctest.debug_script that runs an arbitrary shell command on deserialization, then uploads it to a public model hub or a supply-chain artifact source the victim consumes from. The victim's ingestion pipeline runs picklescan as a pre-load safety gate, which reports the file clean because it doesn't recognize the doctest.debug_script pattern. A user or automated pipeline then calls pickle.load() on the file — expecting a normal model checkpoint — which instead executes the attacker's code with the privileges of the training job, CI runner, or inference host, enabling credential theft, lateral movement, or downstream model/data poisoning.

Weaknesses (CWE)

CWE-502 Deserialization of Untrusted Data Primary CWE-502 Deserialization of Untrusted Data

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.