CVE-2025-71371: picklescan malicious pickle bypasses

CISO Take

picklescan is the open-source tool many ML teams rely on to vet pickle files — including serialized models — before loading them, and versions before 0.0.29 miss a specific gadget that abuses code.InteractiveInterpreter.runcode inside a reduce method, letting a malicious pickle sail through as 'clean'. That matters because pickle deserialization is a well-known RCE vector in the AI supply chain, and this CVE specifically defeats the control organizations put in place to catch it — with CVSS 8.1 (network, low complexity, no privileges) the only real barrier is getting a user to load the crafted file. Exploitation likelihood sits in the top 61% by EPSS but there is no known public exploit, no Nuclei template, and it is not in CISA KEV, so this is a supply-chain integrity gap rather than an active campaign today. Any pipeline that gates untrusted model or data downloads on picklescan clearance should upgrade to 0.0.29+ immediately and treat prior 'clean' scan results on externally-sourced pickle files as unverified.

Sources: NVD GitHub Advisory EPSS ATLAS vulncheck.com

What is the risk?

HIGH risk for AI/ML organizations that use picklescan as a security gate before loading third-party or user-submitted pickle files (e.g., model hub downloads, internal model registries). The flaw is a false negative in a security control rather than a directly remotely-triggerable exploit on its own — impact only materializes when a downstream consumer calls pickle.load() on a file that picklescan incorrectly cleared. CVSS 8.1 reflects high confidentiality and integrity impact (arbitrary code execution) with no privileges required, though user interaction is required to trigger the load. EPSS at the 61st percentile suggests moderate real-world exploitation interest, but the absence of a public PoC, Nuclei template, or KEV listing means this is currently a proof-of-concept-level bypass rather than an actively weaponized attack. Exposure scales with how many organizations treat a passing picklescan result as sufficient trust to skip sandboxing or other isolation when loading models.

How does the attack unfold?

Craft malicious artifact

Attacker builds a pickle file whose reduce method invokes code.InteractiveInterpreter.runcode to smuggle arbitrary Python code.

AML.T0011.000

Distribute via AI supply chain

Attacker publishes or sends the poisoned artifact disguised as a legitimate model or data file expecting it to pass automated vetting.

AML.T0010.001

Evade scanner detection

picklescan versions before 0.0.29 fail to flag the reduce gadget, so the artifact is marked clean and passes the security gate.

AML.T0107

Code execution on load

A user or automated pipeline calls pickle.load() on the 'cleared' artifact, triggering arbitrary code execution with the loading process's privileges.

AML.T0011

Craft malicious artifact

Attacker builds a pickle file whose reduce method invokes code.InteractiveInterpreter.runcode to smuggle arbitrary Python code.

AML.T0011.000

Distribute via AI supply chain

Attacker publishes or sends the poisoned artifact disguised as a legitimate model or data file expecting it to pass automated vetting.

AML.T0010.001

Evade scanner detection

picklescan versions before 0.0.29 fail to flag the reduce gadget, so the artifact is marked clean and passes the security gate.

AML.T0107

Code execution on load

A user or automated pipeline calls pickle.load() on the 'cleared' artifact, triggering arbitrary code execution with the loading process's privileges.

AML.T0011

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
picklescan	pip	—	No patch
418 3 dependents Pushed 25d ago 53% patched ~12d to patch Full package profile →

Do you use picklescan? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 40% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Unchanged

C High

I High

A None

What should I do?

1 step

Upgrade picklescan to 0.0.29 or later immediately in any pipeline that uses it as a security gate. As defense-in-depth, do not rely on picklescan (or any pickle scanner) as the sole control — prefer safetensors or other non-executable serialization formats for model artifacts wherever possible, and load pickle files only inside sandboxed/isolated environments regardless of scan result. For detection, audit logs for any pickle.load() calls on artifacts scanned by picklescan versions before 0.0.29, and re-scan historical 'clean' artifacts with the patched version before trusting them. Monitor for anomalous process spawning or interactive-interpreter activity immediately following model or artifact load events.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Supply Chain Model AML.T0010.001 - AI Software AML.T0011.000 - Unsafe AI Artifacts AML.T0018.002 - Embed Malware AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.10.2 - Third-party and supplier relationships

NIST AI RMF

GOVERN 6.1 - Policies and procedures for third-party AI risks

OWASP LLM Top 10

LLM03:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2025-71371?

picklescan is the open-source tool many ML teams rely on to vet pickle files — including serialized models — before loading them, and versions before 0.0.29 miss a specific gadget that abuses code.InteractiveInterpreter.runcode inside a reduce method, letting a malicious pickle sail through as 'clean'. That matters because pickle deserialization is a well-known RCE vector in the AI supply chain, and this CVE specifically defeats the control organizations put in place to catch it — with CVSS 8.1 (network, low complexity, no privileges) the only real barrier is getting a user to load the crafted file. Exploitation likelihood sits in the top 61% by EPSS but there is no known public exploit, no Nuclei template, and it is not in CISA KEV, so this is a supply-chain integrity gap rather than an active campaign today. Any pipeline that gates untrusted model or data downloads on picklescan clearance should upgrade to 0.0.29+ immediately and treat prior 'clean' scan results on externally-sourced pickle files as unverified.

Is CVE-2025-71371 actively exploited?

No confirmed active exploitation of CVE-2025-71371 has been reported, but organizations should still patch proactively.

How to fix CVE-2025-71371?

Upgrade picklescan to 0.0.29 or later immediately in any pipeline that uses it as a security gate. As defense-in-depth, do not rely on picklescan (or any pickle scanner) as the sole control — prefer safetensors or other non-executable serialization formats for model artifacts wherever possible, and load pickle files only inside sandboxed/isolated environments regardless of scan result. For detection, audit logs for any pickle.load() calls on artifacts scanned by picklescan versions before 0.0.29, and re-scan historical 'clean' artifacts with the patched version before trusting them. Monitor for anomalous process spawning or interactive-interpreter activity immediately following model or artifact load events.

What systems are affected by CVE-2025-71371?

This vulnerability affects the following AI/ML architecture patterns: model serving, MLOps pipelines, AI supply chain / model registries, CI/CD for ML.

What is the CVSS score for CVE-2025-71371?

CVE-2025-71371 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.50%.

What is the AI security impact?

Affected AI Architectures

model servingMLOps pipelinesAI supply chain / model registriesCI/CD for ML

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0011.000 Unsafe AI Artifacts

AML.T0018.002 Embed Malware

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.10.2

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM03:2025

What are the technical details?

Original Advisory

picklescan before 0.0.29 fails to detect malicious pickle files using code.InteractiveInterpreter.runcode in reduce methods. Attackers can craft pickle payloads that bypass picklescan detection and execute arbitrary code when loaded via pickle.load().

Exploitation Scenario

An attacker uploads a poisoned 'model' file to a public model hub or sends it directly to a target organization disguised as a pretrained checkpoint. The pickle payload's reduce method is crafted to invoke code.InteractiveInterpreter.runcode with attacker-controlled Python code — a gadget picklescan versions before 0.0.29 don't recognize as dangerous. The target's MLOps pipeline runs picklescan as an automated pre-load security gate, the file passes as 'clean', and a data scientist or automated job then calls pickle.load() on it to use the model, at which point the embedded code executes with the privileges of that process — potentially exfiltrating credentials, pivoting into internal infrastructure, or tampering with the training/inference pipeline.

Weaknesses (CWE)

CWE-502 Deserialization of Untrusted Data Primary CWE-502 Deserialization of Untrusted Data

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.