AI Threat Alert
CVE-2025-71372: Picklescan: RCE gadget bypasses pickle safety scanner
HIGH CISA: ATTENDPicklescan is the de-facto safety scanner used to vet pickle-serialized model files before loading, but versions before 0.0.33 fail to flag the numpy.f2py.crackfortran.getlincoef gadget hidden in a pickle __reduce__ method, letting arbitrary Python code execute the moment a "scanned safe" file is deserialized. The CVSS 8.1 score reflects high confidentiality and integrity impact with no privileges required, though user interaction is needed to trigger the load; there is no known public exploit, no Nuclei template, and it is not in CISA KEV, so exploitation likelihood today is low but the trust-bypass nature of the flaw makes it a high-value supply-chain vector once weaponized. Because Picklescan is specifically relied upon as a defensive control at model ingestion points (HuggingFace Hub downloads, MLOps pipelines, shared model registries), any organization treating a Picklescan pass as sufficient proof of safety is currently exposed to a false sense of security. Upgrade to Picklescan 0.0.33 or later immediately, and until upgraded, treat any pickle-format model file from an untrusted or public source as unsafe regardless of scan result — prefer safetensors or other non-executable formats, and audit recent model ingestions for pickle files that passed scanning but originated from low-trust sources.
What is the risk?
High risk for organizations whose model-ingestion or ML supply-chain workflow relies on Picklescan as a gating control. Exploitability is moderate-to-high in principle (network vector, low complexity, no privileges) but requires a victim to load a malicious pickle file, and no public exploit or scanner signature exists yet, keeping near-term opportunistic exploitation probability low. The real danger is systemic: this is a detection-bypass vulnerability, meaning affected environments believe they are protected when they are not, which can mask silent supply-chain poisoning until a breach is discovered by other means.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| picklescan | pip | — | No patch |
Do you use picklescan? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step-
Upgrade picklescan to >= 0.0.33 immediately across all systems that use it as a gating control. Until upgraded, do not treat a Picklescan pass as authoritative — re-verify provenance of any pickle file from external sources (HuggingFace, forums, unofficial mirrors) via checksum/signature or by re-scanning after the patch. Where feasible, migrate model artifact storage to safetensors or other non-executable serialization formats that eliminate __reduce__-based code execution entirely. For detection, monitor for pickle loads following the patch window that were previously cleared by an older Picklescan version, and add a secondary static-analysis or sandboxed deserialization check for high-value model ingestion pipelines rather than relying on a single scanner.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2025-71372?
Picklescan is the de-facto safety scanner used to vet pickle-serialized model files before loading, but versions before 0.0.33 fail to flag the numpy.f2py.crackfortran.getlincoef gadget hidden in a pickle __reduce__ method, letting arbitrary Python code execute the moment a "scanned safe" file is deserialized. The CVSS 8.1 score reflects high confidentiality and integrity impact with no privileges required, though user interaction is needed to trigger the load; there is no known public exploit, no Nuclei template, and it is not in CISA KEV, so exploitation likelihood today is low but the trust-bypass nature of the flaw makes it a high-value supply-chain vector once weaponized. Because Picklescan is specifically relied upon as a defensive control at model ingestion points (HuggingFace Hub downloads, MLOps pipelines, shared model registries), any organization treating a Picklescan pass as sufficient proof of safety is currently exposed to a false sense of security. Upgrade to Picklescan 0.0.33 or later immediately, and until upgraded, treat any pickle-format model file from an untrusted or public source as unsafe regardless of scan result — prefer safetensors or other non-executable formats, and audit recent model ingestions for pickle files that passed scanning but originated from low-trust sources.
Is CVE-2025-71372 actively exploited?
No confirmed active exploitation of CVE-2025-71372 has been reported, but organizations should still patch proactively.
How to fix CVE-2025-71372?
Upgrade picklescan to >= 0.0.33 immediately across all systems that use it as a gating control. Until upgraded, do not treat a Picklescan pass as authoritative — re-verify provenance of any pickle file from external sources (HuggingFace, forums, unofficial mirrors) via checksum/signature or by re-scanning after the patch. Where feasible, migrate model artifact storage to safetensors or other non-executable serialization formats that eliminate __reduce__-based code execution entirely. For detection, monitor for pickle loads following the patch window that were previously cleared by an older Picklescan version, and add a secondary static-analysis or sandboxed deserialization check for high-value model ingestion pipelines rather than relying on a single scanner.
What systems are affected by CVE-2025-71372?
This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines, MLOps/CI-CD model registries.
What is the CVSS score for CVE-2025-71372?
CVE-2025-71372 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.38%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0010.003 Model AML.T0011 User Execution AML.T0011.000 Unsafe AI Artifacts AML.T0018.002 Embed Malware AML.T0058 Publish Poisoned Models Compliance Controls Affected
What are the technical details?
Original Advisory
Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran.getlincoef gadget in pickle __reduce__ methods, allowing arbitrary code execution. Attackers can craft malicious pickle files that execute arbitrary Python code when loaded, bypassing Picklescan's safety checks and enabling supply-chain poisoning of shared model files.
Exploitation Scenario
An adversary crafts a malicious pickle-serialized model artifact whose __reduce__ method points to the numpy.f2py.crackfortran.getlincoef gadget — a function Picklescan (pre-0.0.33) does not recognize as dangerous — and uploads it to a public model hub or shares it via a community channel, disguised as a legitimate fine-tuned checkpoint. A victim's MLOps pipeline or data scientist downloads the file, runs it through Picklescan as a routine safety gate, receives a clean/safe verdict, and proceeds to pickle.load() the file into a training or inference environment. At that moment the embedded gadget executes arbitrary Python code with the privileges of the loading process, giving the attacker code execution inside the victim's ML infrastructure — a classic supply-chain poisoning outcome enabled purely by trusting a bypassed scanner.
Weaknesses (CWE)
CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
- [Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
- [Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N References
Timeline
Related Vulnerabilities
CVE-2026-3490 10.0 picklescan: blocklist bypass enables full RCE
Same package: picklescan GHSA-vvpj-8cmc-gx39 10.0 picklescan: security flaw enables exploitation
Same package: picklescan GHSA-g38g-8gr9-h9xp 9.8 picklescan: Allowlist Bypass evades input filtering
Same package: picklescan CVE-2025-1945 9.8 picklescan: ZIP flag bypass enables RCE in PyTorch models
Same package: picklescan GHSA-7wx9-6375-f5wh 9.8 picklescan: Allowlist Bypass evades input filtering
Same package: picklescan