Which versions of PickleScan are affected by CVE-2025-71322?

PickleScan, a widely-used security scanner for machine learning model files, contains a code-execution bypass in versions before 0.0.33 that allows attackers to inject malicious payloads past…. A patch is available.

How to fix or mitigate CVE-2025-71322?

Within 24 hours: Identify all PickleScan instances and document current versions; assess whether affected versions (< 0.0.33) are actively scanning production model sources. Within 7 days: Implement compensating controls (sandboxing, source verification) and conduct retrospective review of all models scanned by vulnerable versions in the past 90 days. Within 30 days: Establish model integrity verification independent of PickleScan and evaluate alternative security scanning solutions.

PickleScan CVE-2025-71322

Q: What is the CVSS score of CVE-2025-71322?

CVE-2025-71322 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

HIGH

Protection Mechanism Failure (CWE-693)

2026-06-17 VulnCheck

RCE Picklescan

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Malicious pickle is delivered over the network and requires the victim to load the file (UI:R); no prior auth or privileges are needed, and pickle deserialization yields full code execution (C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 17, 2026 - 16:47 vuln.today

Analysis Generated

Jun 17, 2026 - 16:47 vuln.today

DescriptionCVE.org

PickleScan before 0.0.33 fails to include the pty.spawn function in its unsafe globals list, allowing attackers to bypass security checks. Malicious actors can craft pickle payloads using pty.spawn to achieve arbitrary code execution when files are processed by PickleScan.

AnalysisAI

Security check bypass in PickleScan versions before 0.0.33 allows attackers to smuggle arbitrary code execution payloads past the scanner by invoking the pty.spawn function, which was omitted from the unsafe globals deny-list. Publicly available exploit code exists (released as part of the HeroCTF 2025 'Irreductible 2' challenge writeup), and the flaw is particularly impactful for platforms like Hugging Face and other ML pipelines that rely on PickleScan to vet PyTorch model files. No public exploit identified at time of analysis in CISA KEV.

Technical ContextAI

PickleScan is a static analysis tool maintained by mmaitre314 that inspects Python pickle streams (commonly embedded inside PyTorch .pt/.bin files and ZIP archives) for references to dangerous globals such as os.system, subprocess.Popen, or eval that would execute code when the pickle is deserialized. The tool relies on an allow/deny list of module-function pairs; CWE-693 (Protection Mechanism Failure) applies because the denylist was incomplete - the standard-library pty module's spawn() function, which internally invokes os.execlp on its first argument, was classified merely as 'suspicious' rather than 'dangerous'. An attacker can therefore hand-craft a pickle stream using the GLOBAL opcode to reference pty.spawn with arguments like ['/bin/sh'], and when the pickle is unpickled (e.g., via torch.load) the spawn call yields an interactive shell under the loading process. The CPE cpe:2.3:a:picklescan:picklescan:*:*:* indicates all versions prior to the fix are affected.

RemediationAI

Vendor-released patch: upgrade picklescan to 0.0.33 or later (pip install --upgrade picklescan), which adds pty.spawn to the dangerous-globals list per upstream PR https://github.com/mmaitre314/picklescan/pull/53 and commit 70c1c6c31beb6baaf52c8db1b6c3c0e84a6f9dab. Operators of model-hosting platforms should rebuild and redeploy any container images or services that pin an older picklescan version, and re-scan recently uploaded models with the fixed scanner since previously cleared artifacts may still contain pty.spawn payloads. As compensating controls until the upgrade is rolled out, refuse to deserialize pickle-based model formats and require safer alternatives such as safetensors, or load untrusted models inside a sandboxed/unprivileged container with no shell available on PATH (which neutralises pty.spawn's /bin/sh invocation) - note that the sandbox approach still permits other unsafe globals not covered by this CVE, so it is not a substitute for the patch.