CVE-2025-71369: picklescan picklescan misses

CISO Take

picklescan is the de facto open-source scanner used to vet PyTorch pickle files (.pt/.pkl) before they're trusted and loaded, and this flaw lets an attacker slip a malicious reduce method past it by routing the payload through torch.utils.data.datapipes.utils.decoder.basichandlers, a call the scanner doesn't flag as dangerous. A CISO should care because this isn't a bug in some obscure library — it's a bypass of the exact control many teams rely on to say a downloaded model file is 'safe,' meaning a green scan result no longer guarantees anything; there's no CISA KEV listing, no EPSS score, and no public exploit yet, so this is pre-exploitation rather than actively weaponized, but the bypass technique is now fully documented in the public advisory. The CVSS 8.1 (network, low complexity, no privileges, but requires user interaction to load the file) reflects that the real trigger is a human or pipeline calling torch.load() on an attacker-supplied artifact. Action: upgrade picklescan to >=0.0.28 immediately in any CI/CD, model registry, or intake pipeline that gates on it, and treat picklescan as one layer, not the sole control, for any workflow that ingests third-party pickle-based model files.

Sources: NVD GitHub Advisory ATLAS vulncheck.com

What is the risk?

High severity (CVSS 8.1) but currently theoretical in terms of active exploitation — no KEV listing, no EPSS percentile, no public PoC or Nuclei template found. The real risk is systemic rather than immediate: organizations that treat a clean picklescan result as sufficient proof a model file is safe now have a documented blind spot. Attack complexity is low and no privileges are required, but user interaction (loading/scanning the crafted file) is mandatory, so exposure scales with how much untrusted or third-party model content an organization ingests via pickle rather than safetensors. Because picklescan is widely embedded in model registries, MLOps intake pipelines, and CI checks, the blast radius is broader than a typical single-package CVE — it undermines a shared safety net across the pickle-based ML supply chain.

How does the attack unfold?

Craft malicious model

Attacker embeds a malicious payload in a pickle __reduce__ call referencing torch.utils.data.datapipes.utils.decoder.basichandlers to evade picklescan's detection rules.

AML.T0018.002

Bypass safety scan

Victim scans the file with a vulnerable picklescan (<0.0.28) which reports it as safe, since the reducer isn't on its detection list.

AML.T0107

Victim loads model

Trusting the clean scan, the victim or an automated pipeline deserializes the file via torch.load().

AML.T0011.000

Remote code execution

The embedded reducer executes during deserialization, giving the attacker code execution on the victim's ML host or pipeline.

AML.T0050

Craft malicious model

Attacker embeds a malicious payload in a pickle __reduce__ call referencing torch.utils.data.datapipes.utils.decoder.basichandlers to evade picklescan's detection rules.

AML.T0018.002

Bypass safety scan

Victim scans the file with a vulnerable picklescan (<0.0.28) which reports it as safe, since the reducer isn't on its detection list.

AML.T0107

Victim loads model

Trusting the clean scan, the victim or an automated pipeline deserializes the file via torch.load().

AML.T0011.000

Remote code execution

The embedded reducer executes during deserialization, giving the attacker code execution on the victim's ML host or pipeline.

AML.T0050

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
picklescan	pip	—	No patch
418 3 dependents Pushed 25d ago 53% patched ~12d to patch Full package profile →

Do you use picklescan? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 37% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Unchanged

C High

I High

A None

What should I do?

1 step

Upgrade picklescan to >=0.0.28 in every pipeline, image, and CI job that invokes it. Do not treat picklescan as a sole control — prefer safetensors or other non-executable serialization formats for model weights wherever possible, and restrict pickle-based model loading to fully trusted, internally-produced artifacts. For pipelines that must accept external pickle files, add defense in depth: sandbox/isolate the deserialization step (containerized, network-restricted, non-privileged), monitor for unexpected process spawns or outbound connections during model load, and grep intake artifacts for references to torch.utils.data.datapipes.utils.decoder.basichandlers or other unlisted reducers as an interim detection signal. Cross-check scan results from picklescan against a second tool (e.g., fickling) rather than relying on a single scanner's allow/deny list.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Code Execution Model Framework AML.T0010.001 - AI Software AML.T0011 - User Execution AML.T0011.000 - Unsafe AI Artifacts AML.T0018.002 - Embed Malware

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - Third-party and supplier relationships

NIST AI RMF

MANAGE-2.3 - Third-party AI system risks are monitored and managed

OWASP LLM Top 10

LLM05:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2025-71369?

picklescan is the de facto open-source scanner used to vet PyTorch pickle files (.pt/.pkl) before they're trusted and loaded, and this flaw lets an attacker slip a malicious reduce method past it by routing the payload through torch.utils.data.datapipes.utils.decoder.basichandlers, a call the scanner doesn't flag as dangerous. A CISO should care because this isn't a bug in some obscure library — it's a bypass of the exact control many teams rely on to say a downloaded model file is 'safe,' meaning a green scan result no longer guarantees anything; there's no CISA KEV listing, no EPSS score, and no public exploit yet, so this is pre-exploitation rather than actively weaponized, but the bypass technique is now fully documented in the public advisory. The CVSS 8.1 (network, low complexity, no privileges, but requires user interaction to load the file) reflects that the real trigger is a human or pipeline calling torch.load() on an attacker-supplied artifact. Action: upgrade picklescan to >=0.0.28 immediately in any CI/CD, model registry, or intake pipeline that gates on it, and treat picklescan as one layer, not the sole control, for any workflow that ingests third-party pickle-based model files.

Is CVE-2025-71369 actively exploited?

No confirmed active exploitation of CVE-2025-71369 has been reported, but organizations should still patch proactively.

How to fix CVE-2025-71369?

Upgrade picklescan to >=0.0.28 in every pipeline, image, and CI job that invokes it. Do not treat picklescan as a sole control — prefer safetensors or other non-executable serialization formats for model weights wherever possible, and restrict pickle-based model loading to fully trusted, internally-produced artifacts. For pipelines that must accept external pickle files, add defense in depth: sandbox/isolate the deserialization step (containerized, network-restricted, non-privileged), monitor for unexpected process spawns or outbound connections during model load, and grep intake artifacts for references to torch.utils.data.datapipes.utils.decoder.basichandlers or other unlisted reducers as an interim detection signal. Cross-check scan results from picklescan against a second tool (e.g., fickling) rather than relying on a single scanner's allow/deny list.

What systems are affected by CVE-2025-71369?

This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines, MLOps / model registries, AI supply chain / model distribution.

What is the CVSS score for CVE-2025-71369?

CVE-2025-71369 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.45%.

What is the AI security impact?

Affected AI Architectures

model servingtraining pipelinesMLOps / model registriesAI supply chain / model distribution

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0011 User Execution

AML.T0011.000 Unsafe AI Artifacts

AML.T0018.002 Embed Malware

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE-2.3

OWASP LLM Top 10: LLM05:2025

What are the technical details?

Original Advisory

picklescan before 0.0.28 fails to detect malicious pickle files that use torch.utils.data.datapipes.utils.decoder.basichandlers in reduce methods, allowing attackers to bypass safety checks. Remote attackers can embed undetected malicious code in pickle files that executes during deserialization, enabling remote code execution.

Exploitation Scenario

An attacker builds a PyTorch model file and embeds a malicious payload inside a pickle __reduce__ call that references torch.utils.data.datapipes.utils.decoder.basichandlers instead of a commonly-blocklisted function — a reducer picklescan's ruleset (pre-0.0.28) doesn't recognize as dangerous. The attacker publishes or directly delivers this file to a victim organization (e.g., uploaded to a model-sharing platform, sent as a 'fine-tuned checkpoint,' or slipped into a CI pipeline via a compromised dependency). The victim's intake process runs picklescan, which reports the file as clean, giving engineers false confidence to proceed. When the file is loaded via torch.load() in a training, inference, or CI/CD context, the pickle deserializes and the embedded reducer executes attacker-controlled code, granting remote code execution on the host — from which the attacker can pivot to steal credentials, exfiltrate training data or proprietary models, or tamper with downstream deployments.

Weaknesses (CWE)

CWE-502 Deserialization of Untrusted Data Primary CWE-502 Deserialization of Untrusted Data

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.