picklescan
CVE-2025-71320
CRITICAL
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered malicious pickle, no auth, but victim must load the file (UI:R); full RCE yields C/I/A High, scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
picklescan before 0.0.33 contains an incomplete deny-list that fails to block pydoc.locate and operator.methodcaller functions, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle files using these unblocked functions to achieve arbitrary code execution when the pickle is deserialized.
AnalysisAI
Arbitrary code execution in picklescan before 0.0.33 allows remote attackers to bypass the scanner's malicious-pickle detection by using pydoc.locate and operator.methodcaller, which were missing from the deny-list. Any downstream tool that trusts a 'clean' picklescan verdict and then deserializes the pickle (e.g., ML model loaders) will execute attacker-supplied code. Publicly available exploit code exists (GHSA PoC), and CVSS 4.0 is rated 9.3 Critical, though no public exploit identified at time of analysis in CISA KEV.
Technical ContextAI
picklescan is a Python package (cpe:2.3:a:picklescan:picklescan) widely used in the ML ecosystem - notably by Hugging Face - to statically inspect pickle files for dangerous opcodes/imports before they are unpickled into model weights. It relies on an explicit deny-list of module.function pairs treated as dangerous. CWE-184 (Incomplete List of Disallowed Inputs) applies directly: the list enumerated only some pydoc and operator functions, so pydoc.locate (which dynamically resolves any module name to a live module object, e.g. 'os') and operator.methodcaller (which returns a callable that invokes a named method on its argument, e.g. 'system') passed through unflagged. Chained together inside __reduce__, they reproduce the classic os.system gadget while evading the scanner.
RemediationAI
Vendor-released patch: upgrade picklescan to 0.0.33 or later (pip install -U 'picklescan>=0.0.33'), which extends the deny-list for the pydoc and operator modules to a wildcard so any use of those modules is flagged as dangerous; the fix is tracked in PR https://github.com/mmaitre314/picklescan/pull/53 and commit 70c1c6c31beb6baaf52c8db1b6c3c0e84a6f9dab, with full details in advisory https://github.com/mmaitre314/picklescan/security/advisories/GHSA-84r2-jw7c-4r5q. If immediate upgrade is not possible, treat picklescan 'safe/suspicious' verdicts as untrusted for pickle files originating from external sources, and instead refuse to deserialize raw pickles - prefer safetensors or other non-executable model formats, which eliminates the pickle attack surface entirely at the cost of needing format-converted artifacts. As a narrower stopgap, sandbox unpickling in a no-network, read-only container (limits blast radius but does not prevent in-container code execution), or extend a local fork's deny-list to treat pydoc.* and operator.* as dangerous (matches the upstream fix but must be maintained manually).
More from same product – last 7 days
Remote code execution against users of picklescan versions prior to 1.0.4 is achievable by smuggling any blocked functio
Arbitrary code execution in picklescan versions prior to 1.0.1 allows attackers to bypass the scanner's malicious pickle
Arbitrary file write in picklescan before 0.0.33 lets attackers bypass the tool's dangerous-call blocklist by abusing di
Remote code execution in picklescan before 0.0.33 enables attackers to bypass the tool's malicious-pickle detection by s
Detection bypass in picklescan versions prior to 0.0.27 allows attackers to smuggle malicious Python pickle files past t
Share
External POC / Exploit Code
Leaving vuln.today