picklescan
CVE-2025-71323
CRITICAL
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker supplies a pickle remotely (AV:N, PR:N), but a victim action (scanning then loading the file) is required, so UI:R; full RCE yields C/I/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
picklescan before 0.0.33 fails to block the ctypes module, allowing attackers to achieve remote code execution by invoking direct syscalls and accessing raw memory. Attackers can craft malicious pickle files using ctypes.WinDLL to load kernel32.dll and execute arbitrary commands, bypassing sandbox protections and gadget chain detection.
AnalysisAI
Remote code execution in picklescan before 0.0.33 enables attackers to bypass the tool's malicious-pickle detection by smuggling the unblocked ctypes module into a pickle payload. A working POC demonstrates loading kernel32.dll via ctypes.WinDLL and invoking WinExec to launch arbitrary commands during pickle deserialization scans or downstream loads. Publicly available exploit code exists in the GHSA-4675-36f9-wf6r advisory, and the flaw undermines the very security guarantee picklescan is deployed to provide for ML model pipelines.
Technical ContextAI
picklescan is a Python tool widely used to vet pickle files (commonly Hugging Face/PyTorch model artifacts) for dangerous imports before deserialization. Its denylist of risky modules omitted ctypes, Python's foreign function interface that can load native shared libraries, call C functions, and access raw memory. CWE-184 (Incomplete List of Disallowed Inputs) captures the root cause: an allow-by-default scanner whose blocklist failed to enumerate a class of equally dangerous primitives. Because pickle's __reduce__ protocol can chain arbitrary callables, an attacker can construct ctypes.WinDLL('kernel32.dll'), retrieve WinExec via operator.itemgetter, and invoke it with operator.methodcaller - none of which trip picklescan's gadget detection.
RemediationAI
Vendor-released patch: upgrade picklescan to 0.0.33 or later (fix landed in https://github.com/mmaitre314/picklescan/pull/53, commit 70c1c6c31beb6baaf52c8db1b6c3c0e84a6f9dab); pin this minimum version in requirements.txt, Poetry/Pipenv lockfiles, and any CI image baselines. If immediate upgrade is not possible, add ctypes (and related FFI modules such as cffi) to a wrapper denylist around picklescan or pre-filter pickle opcodes that reference ctypes.* before passing files to picklescan - note this is fragile and will miss aliasing. As a stronger compensating control, treat picklescan results as advisory only and load untrusted pickles inside a sandboxed worker with no native library access (seccomp on Linux, AppContainer/Job Object on Windows), accepting the trade-off of added latency and operational complexity. Refer to the GHSA-4675-36f9-wf6r advisory for vendor guidance.
More from same product – last 7 days
Remote code execution against users of picklescan versions prior to 1.0.4 is achievable by smuggling any blocked functio
Arbitrary code execution in picklescan before 0.0.33 allows remote attackers to bypass the scanner's malicious-pickle de
Arbitrary file write in picklescan before 0.0.33 lets attackers bypass the tool's dangerous-call blocklist by abusing di
Detection bypass in picklescan versions prior to 0.0.27 allows attackers to smuggle malicious Python pickle files past t
Arbitrary code execution bypass in picklescan before 1.0.4 allows attackers to smuggle malicious pickle files past the s
Share
External POC / Exploit Code
Leaving vuln.today