picklescan
CVE-2025-71321
CRITICAL
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Payload is delivered network-wide (e.g., model hub) but the victim must choose to scan-then-load an attacker-supplied pickle, so UI:R; no auth needed and impact is full host compromise.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
picklescan before 0.0.33 contains an arbitrary file writing vulnerability that allows attackers to bypass the dangerous blocklist by using distutils.file_util.write_file. Attackers can construct malicious pickle objects to overwrite critical system files and achieve denial of service or remote code execution.
AnalysisAI
Arbitrary file write in picklescan before 0.0.33 lets attackers bypass the tool's dangerous-call blocklist by abusing distutils.file_util.write_file inside crafted pickle payloads. Because picklescan is used as a safety gate before loading ML model pickles, a bypass means malicious models pass scanning and can overwrite files on disk to achieve denial of service or remote code execution. Publicly available exploit code exists in the GHSA advisory, though there is no public exploit identified at time of analysis indicating active exploitation.
Technical ContextAI
picklescan is a Python library used to statically inspect pickle files (commonly Hugging Face / PyTorch model artifacts) for dangerous opcodes and imports before unpickling. It maintains a denylist of known-bad callables such as builtins.open and shutil.* that can be used to write or overwrite files via pickle's __reduce__ mechanism. The root cause is CWE-502 (Deserialization of Untrusted Data) compounded by an incomplete blocklist: distutils.file_util.write_file performs the same arbitrary file write primitive but was not enumerated, so a __reduce__ returning (distutils.file_util.write_file, (path, lines)) is reported as safe by the scanner and then writes attacker-controlled content when the consuming application loads the pickle. The affected component is cpe:2.3:a:picklescan:picklescan:* up to 0.0.32.
RemediationAI
Vendor-released patch: upgrade picklescan to 0.0.33 or later (pip install --upgrade picklescan), which adds distutils to the dangerous globals list per the upstream fix in https://github.com/mmaitre314/picklescan/pull/53 and commit 70c1c6c31beb6baaf52c8db1b6c3c0e84a6f9dab; see the advisory at https://github.com/mmaitre314/picklescan/security/advisories/GHSA-m273-6v24-x4m4. Where immediate upgrade is not possible, supplement scanning by extending your own denylist to include distutils.file_util.write_file (and audit for other writable callables such as os.* and pathlib writes), or refuse to unpickle any model from untrusted sources and prefer safetensors-format weights instead - the trade-off is that legitimate distutils-using pickles will be blocked and migrating off pickle requires re-saving models. Treat picklescan as one defense layer only and sandbox the unpickling process (separate user, read-only filesystem, no SSH key access) so that even an arbitrary write cannot reach .ssh/authorized_keys or webroot config.
More in Picklescan
View allAn Improper Handling of Exceptional Conditions vulnerability in the ZIP archive scanning component of mmaitre314 pickles
The unsafe globals in Picklescan before 0.0.25 do not include ssl. Rated medium severity (CVSS 6.8), this vulnerability
picklescan before 0.0.21 does not treat 'pip' as an unsafe global. Rated medium severity (CVSS 5.3), this vulnerability
Remote code execution against users of picklescan versions prior to 1.0.4 is achievable by smuggling any blocked functio
Arbitrary code execution in picklescan versions prior to 1.0.1 allows attackers to bypass the scanner's malicious pickle
picklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. Rated m
Remote code execution in picklescan versions prior to 1.0.4 allows attackers to bypass the scanner's safety validation b
Arbitrary code execution bypass in picklescan before 1.0.4 allows attackers to smuggle malicious pickle files past the s
Detection bypass in picklescan versions prior to 0.0.27 allows attackers to smuggle malicious Python pickle files past t
Remote code execution in picklescan before 0.0.33 enables attackers to bypass the tool's malicious-pickle detection by s
Arbitrary code execution in picklescan before 0.0.33 allows remote attackers to bypass the scanner's malicious-pickle de
Security check bypass in PickleScan versions before 0.0.33 allows attackers to smuggle arbitrary code execution payloads
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today