picklescan
CVE-2025-71323
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconCraft pickle with ctypes.WinDLL reduce chain
-
DeliveryDeliver as ML model or pickle artifact
-
ExploitVictim runs picklescan < 0.0.33
-
InstallScanner returns clean (ctypes not blocked)
-
C2Victim pickle.load executes chain
-
Executekernel32.WinExec runs arbitrary command
-
ImpactCode execution in loader context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation completeness
|
| Exploitation Conditions | Exploitation requires that a victim system runs picklescan version < 0.0.33 against an attacker-controlled pickle file AND subsequently deserializes that pickle (or otherwise trusts picklescan's clean verdict). No authentication, user interaction, or network listener is needed on the victim side beyond the act of scanning/loading the supplied file. The demonstrated POC targets Windows because it calls ctypes.WinDLL('kernel32.dll')/WinExec, but the same primitive works on Linux/macOS by substituting ctypes.CDLL and libc symbols, so platform is not a meaningful limiter. The realistic limiting factor is delivery: the attacker must get the malicious pickle into the victim's scanning/loading pipeline, which is trivial in public ML model-hub workflows but harder in closed environments. |
| Impact | The CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H scores 9.3 and accurately reflects that an attacker only needs to deliver a malicious pickle file (e.g., a model uploaded to a hub) to a system that scans then loads it. SSVC-style signals are mixed: a working POC exists and the exploit is automatable, but there is no CISA KEV listing and no EPSS data was supplied, so this is best characterized as a high-impact, low-friction supply-chain risk against ML pipelines rather than confirmed mass exploitation. The real-world severity is amplified because picklescan is a security control - a bypass here causes downstream tools (model loaders, CI scanners) to wrongly attest a malicious artifact as safe, which is a higher-order risk than a vanilla RCE in an isolated library. |
| Exploit ScenarioDerived | An attacker uploads a malicious pickle (e.g., a PyTorch model on a public hub) whose __reduce__ chain loads kernel32.dll via ctypes.WinDLL, resolves WinExec with operator.itemgetter, and executes calc.exe or a downloader. A defender or CI pipeline runs picklescan ≤ 0.0.32, receives a clean verdict, and proceeds to pickle.load the artifact - at which point arbitrary commands execute in the loader's security context. The published POC in the GHSA advisory is copy-pasteable and produces calc_exploit.pkl in seconds. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 17, 2026
Remote code execution in picklescan before 0.0.33 enables attackers to bypass the tool's malicious-pickle detection by smuggling the unblocked ctypes module into a pickle payload. A working POC demonstrates loading kernel32.dll via ctypes.WinDLL and invoking WinExec to launch arbitrary commands during pickle deserialization scans or downstream loads. Publicly available exploit code exists in the GHSA-4675-36f9-wf6r advisory, and the flaw undermines the very security guarantee picklescan is deployed to provide for ML model pipelines.
RemediationAI
Vendor-released patch: upgrade picklescan to 0.0.33 or later (fix landed in https://github.com/mmaitre314/picklescan/pull/53, commit 70c1c6c31beb6baaf52c8db1b6c3c0e84a6f9dab); pin this minimum version in requirements.txt, Poetry/Pipenv lockfiles, and any CI image baselines. If immediate upgrade is not possible, add ctypes (and related FFI modules such as cffi) to a wrapper denylist around picklescan or pre-filter pickle opcodes that reference ctypes.* before passing files to picklescan - note this is fragile and will miss aliasing. As a stronger compensating control, treat picklescan results as advisory only and load untrusted pickles inside a sandboxed worker with no native library access (seccomp on Linux, AppContainer/Job Object on Windows), accepting the trade-off of added latency and operational complexity. Refer to the GHSA-4675-36f9-wf6r advisory for vendor guidance.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
picklescan is a Python tool widely used to vet pickle files (commonly Hugging Face/PyTorch model artifacts) for dangerous imports before deserialization. Its denylist of risky modules omitted ctypes, Python's foreign function interface that can load native shared libraries, call C functions, and access raw memory. CWE-184 (Incomplete List of Disallowed Inputs) captures the root cause: an allow-by-default scanner whose blocklist failed to enumerate a class of equally dangerous primitives. Because pickle's __reduce__ protocol can chain arbitrary callables, an attacker can construct ctypes.WinDLL('kernel32.dll'), retrieve WinExec via operator.itemgetter, and invoke it with operator.methodcaller - none of which trip picklescan's gadget detection.
Know when Picklescan gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Attacker supplies a pickle remotely (AV:N, PR:N), but a victim action (scanning then loading the file) is required, so UI:R; full RCE yields C/I/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
picklescan before 0.0.33 fails to block the ctypes module, allowing attackers to achieve remote code execution by invoking direct syscalls and accessing raw memory. Attackers can craft malicious pickle files using ctypes.WinDLL to load kernel32.dll and execute arbitrary commands, bypassing sandbox protections and gadget chain detection.
Executive ViewAI
picklescan, a critical security tool used to validate machine learning model pipelines, contains a remote code execution vulnerability that completely bypasses its malicious-pickle detection mechanism. Attackers can execute arbitrary code within ML pipeline environments and downstream systems using publicly available exploit code, undermining the primary security assurance organizations depend on. Without immediate protective action, production ML workflows and sensitive model data face undetected compromise.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable picklescan in critical ML pipeline workflows until patched version released; (2) Restrict pickle deserialization operations to air-gapped or segregated-network environments with strict egress controls; (3) Deploy endpoint detection and response (EDR) monitoring on systems handling pickle files to identify exploitation attempts; (4) Mandate security review and vendor authentication for all untrusted machine learning models before acceptance into pipelines; (5) Evaluate and deploy alternative malicious-pickle detection libraries or request security attestations from ML model suppliers as supplementary validation controls.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
More in Picklescan
View allAn Improper Handling of Exceptional Conditions vulnerability in the ZIP archive scanning component of mmaitre314 pickles
A Protection Mechanism Failure vulnerability in mmaitre314 picklescan versions up to and including 0.0.30 allows a remot
An Improper Input Validation vulnerability in the scanning logic of mmaitre314 picklescan versions up to and including 0
Detection bypass in picklescan prior to 0.0.29 allows attackers to smuggle remote code execution payloads through pickle
Detection bypass in picklescan versions before 0.0.25 allows attackers to embed remote code execution payloads in pickle
Detection bypass in picklescan before 0.0.28 allows attackers to embed malicious torch.jit.unsupported_tensor_ops.execWr
Detection bypass in picklescan before 0.0.28 allows attackers to smuggle arbitrary code through pickle files by abusing
Detection bypass in picklescan before 0.0.29 allows malicious pickle files to evade scanning by abusing the undetected i
Detection bypass in picklescan versions before 0.0.30 allows malicious pickle files to evade security scanning by using
Detection bypass in picklescan versions prior to 0.0.29 allows attackers to smuggle arbitrary code execution payloads th
Detection bypass in picklescan before 0.0.33 allows attackers to smuggle arbitrary code through malicious pickle files b
Detection bypass in picklescan before 0.0.29 allows attackers to craft malicious pickle files using idlelib.debugobj.Obj
Exploit-DB