AI Threat Alert
CVE-2025-71374: picklescan: scanner bypass enables pickle RCE
HIGH CISA: ATTENDpicklescan is the scanner many ML teams rely on to vet pickle-format model files before loading them, and versions before 0.0.29 fail to flag a REDUCE call to the built-in profile.Profile.run, so a malicious pickle can sail through the scan looking clean and then execute arbitrary code the moment it's deserialized. This matters because picklescan is used as a trust boundary, not just a convenience check — teams gating model ingestion on 'picklescan passed' now have a false sense of safety, and the CVSS 8.1 score (network vector, low complexity, no privileges required) reflects how trivial the bypass is to reuse once the technique is known. Exploitation likelihood currently sits at only the 54th EPSS percentile with no public PoC, no scanner template, and no CISA KEV listing, so there is no evidence of active exploitation yet, but deserialization bypasses (CWE-502) are a recurring vector in AI supply-chain attacks against public model hubs. Upgrade picklescan to 0.0.29 or later immediately, and stop treating a clean picklescan result as sufficient on its own — pair it with sandboxed model loading, prefer safetensors for new models where possible, and retroactively audit any pickle/model files already ingested for reduce calls into profile, pdb, or similar stdlib modules with run/exec-style entry points that static scanners commonly miss.
What is the risk?
High severity (CVSS 8.1) but currently low observed exploitation likelihood (EPSS 54th percentile, no public exploit or scanner template, not in CISA KEV). The real risk is architectural: this is a defense-evasion flaw in a security control specifically built to protect the AI/ML pickle-loading trust boundary. Because user interaction (loading/deserializing the crafted file) is required, exposure depends entirely on how automated or trusting an organization's model-ingestion pipeline is — pipelines that auto-load any file passing picklescan without further sandboxing carry the most risk. No downstream dependent count or OpenSSF score is available, so blast radius is estimated qualitatively as 'anyone using picklescan as a sole safety gate for pickle model files.'
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| picklescan | pip | — | No patch |
Do you use picklescan? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step-
1) Upgrade picklescan to version 0.0.29 or later immediately. 2) Do not rely on picklescan (or any single static scanner) as the sole control for untrusted pickle files — add sandboxed/isolated deserialization (e.g., load in a locked-down container with no network/filesystem access) as defense in depth. 3) Where feasible, migrate model storage to safetensors or other non-executable serialization formats instead of pickle. 4) Retroactively re-scan and manually audit any pickle files ingested while running picklescan < 0.0.29, specifically searching pickle opcode streams for REDUCE calls into profile.Profile.run or other stdlib callables with code-execution side effects. 5) Add runtime detection/alerting for unexpected process execution or profiling-module activity immediately following a model-load event.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2025-71374?
picklescan is the scanner many ML teams rely on to vet pickle-format model files before loading them, and versions before 0.0.29 fail to flag a REDUCE call to the built-in profile.Profile.run, so a malicious pickle can sail through the scan looking clean and then execute arbitrary code the moment it's deserialized. This matters because picklescan is used as a trust boundary, not just a convenience check — teams gating model ingestion on 'picklescan passed' now have a false sense of safety, and the CVSS 8.1 score (network vector, low complexity, no privileges required) reflects how trivial the bypass is to reuse once the technique is known. Exploitation likelihood currently sits at only the 54th EPSS percentile with no public PoC, no scanner template, and no CISA KEV listing, so there is no evidence of active exploitation yet, but deserialization bypasses (CWE-502) are a recurring vector in AI supply-chain attacks against public model hubs. Upgrade picklescan to 0.0.29 or later immediately, and stop treating a clean picklescan result as sufficient on its own — pair it with sandboxed model loading, prefer safetensors for new models where possible, and retroactively audit any pickle/model files already ingested for reduce calls into profile, pdb, or similar stdlib modules with run/exec-style entry points that static scanners commonly miss.
Is CVE-2025-71374 actively exploited?
No confirmed active exploitation of CVE-2025-71374 has been reported, but organizations should still patch proactively.
How to fix CVE-2025-71374?
1) Upgrade picklescan to version 0.0.29 or later immediately. 2) Do not rely on picklescan (or any single static scanner) as the sole control for untrusted pickle files — add sandboxed/isolated deserialization (e.g., load in a locked-down container with no network/filesystem access) as defense in depth. 3) Where feasible, migrate model storage to safetensors or other non-executable serialization formats instead of pickle. 4) Retroactively re-scan and manually audit any pickle files ingested while running picklescan < 0.0.29, specifically searching pickle opcode streams for REDUCE calls into profile.Profile.run or other stdlib callables with code-execution side effects. 5) Add runtime detection/alerting for unexpected process execution or profiling-module activity immediately following a model-load event.
What systems are affected by CVE-2025-71374?
This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines, ML model supply chain / registries.
What is the CVSS score for CVE-2025-71374?
CVE-2025-71374 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.64%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0010.003 Model AML.T0011.000 Unsafe AI Artifacts AML.T0018.002 Embed Malware AML.T0107 Exploitation for Defense Evasion Compliance Controls Affected
What are the technical details?
Original Advisory
picklescan before 0.0.29 fails to detect the built-in python profile.Profile.run function when used in pickle reduce methods, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files that bypass picklescan detection and achieve code execution upon deserialization.
Exploitation Scenario
An attacker uploads a trojanized model checkpoint to a public model repository or sends it directly to a target organization disguised as a legitimate pickle-serialized ML artifact. The victim's ingestion pipeline runs picklescan as a pre-load safety gate; because the payload's REDUCE opcode invokes profile.Profile.run rather than a more commonly-blocked function like os.system or subprocess.Popen, picklescan reports the file as clean. An ML engineer or automated pipeline then deserializes the file (e.g., via pickle.load or a framework wrapper), triggering profile.Profile.run with attacker-controlled arguments and achieving arbitrary code execution on the host running the model-loading job — potentially a training server, inference endpoint, or CI/CD pipeline with elevated access to model registries and credentials.
Weaknesses (CWE)
CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
- [Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
- [Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N References
Timeline
Related Vulnerabilities
CVE-2026-3490 10.0 picklescan: blocklist bypass enables full RCE
Same package: picklescan GHSA-vvpj-8cmc-gx39 10.0 picklescan: security flaw enables exploitation
Same package: picklescan GHSA-g38g-8gr9-h9xp 9.8 picklescan: Allowlist Bypass evades input filtering
Same package: picklescan CVE-2025-1945 9.8 picklescan: ZIP flag bypass enables RCE in PyTorch models
Same package: picklescan GHSA-7wx9-6375-f5wh 9.8 picklescan: Allowlist Bypass evades input filtering
Same package: picklescan