picklescan
CVE-2025-71325
CRITICAL
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered malicious pickle, no attacker auth, but a victim must load the file (UI:R); scope changes because the scanner's failure causes RCE in a separate loader process with full C/I/A impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
picklescan before 0.0.27 contains a parsing logic error in the _list_globals function when handling STACK_GLOBAL opcodes, failing to track arguments in the correct range and allowing malicious pickle files to bypass detection. Attackers can craft pickle files with arguments at position zero to trigger unexpected exceptions and evade security scanning.
AnalysisAI
Detection bypass in picklescan versions prior to 0.0.27 allows attackers to smuggle malicious Python pickle files past the scanner by exploiting an off-by-one parsing error in STACK_GLOBAL opcode handling. The flaw, reported by VulnCheck and tracked under GHSA-9gvj-pp9x-gcfr, lets crafted pickles trigger an unexpected exception in _list_globals so dangerous imports such as os.system go unflagged; a working PoC is published in the advisory and a vendor patch is available, though no public exploitation against deployments has been observed.
Technical ContextAI
picklescan is a Python library used to statically scan pickle files for unsafe globals before deserialization, and the same parsing logic was reused by modelscan and by Hugging Face's online pickle scanners. In scanner.py the _list_globals function walks pickle opcodes and, when it sees a STACK_GLOBAL opcode at position n, must locate the two preceding string arguments that name the module and attribute being resolved. The buggy code iterates range(1, n), which excludes position 0, so an attacker who places the first string argument at offset 0 makes the scanner find only one of the two expected arguments and raise an exception that aborts inspection of that opcode rather than logging os.system or similar dangerous globals. CWE-391 (Unchecked Error Condition) captures the root cause: the parser treats its own failure to parse as benign instead of treating an unparseable STACK_GLOBAL as suspicious. CPE coverage is limited to cpe:2.3:a:picklescan:picklescan:*, but the GHSA notes the same logic flaw impacts modelscan and Hugging Face's hosted scanners.
RemediationAI
Vendor-released patch: upgrade picklescan to 0.0.27 or later (pip install --upgrade picklescan>=0.0.27); the corrective change in commit 2a8383cfeb4158567f9770d86597300c9e508d0f fixes the iteration range in _list_globals so that the argument at position 0 is tracked. Confirm any downstream wrappers - notably modelscan and self-hosted forks of the Hugging Face scanner - have either upgraded their picklescan dependency or applied the equivalent range(1, n+1) fix before trusting their verdicts again. As a compensating control until upgrade is complete, treat picklescan/modelscan results as advisory only and either refuse to deserialize third-party pickles outright, transcode models through a safer format such as safetensors before loading, or run pickle.load only inside a sandboxed, network-isolated worker - each of these stops downstream RCE but breaks workflows that rely on transparent pickle ingestion. Monitor for picklescan exceptions or parse errors in scanner logs and reject the file rather than allow-listing on parser failure, since the bypass manifests precisely as an unhandled exception during scan.
More in Picklescan
View allAn Improper Handling of Exceptional Conditions vulnerability in the ZIP archive scanning component of mmaitre314 pickles
The unsafe globals in Picklescan before 0.0.25 do not include ssl. Rated medium severity (CVSS 6.8), this vulnerability
picklescan before 0.0.21 does not treat 'pip' as an unsafe global. Rated medium severity (CVSS 5.3), this vulnerability
Remote code execution against users of picklescan versions prior to 1.0.4 is achievable by smuggling any blocked functio
Arbitrary code execution in picklescan versions prior to 1.0.1 allows attackers to bypass the scanner's malicious pickle
picklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. Rated m
Remote code execution in picklescan versions prior to 1.0.4 allows attackers to bypass the scanner's safety validation b
Arbitrary code execution bypass in picklescan before 1.0.4 allows attackers to smuggle malicious pickle files past the s
Remote code execution in picklescan before 0.0.33 enables attackers to bypass the tool's malicious-pickle detection by s
Arbitrary file write in picklescan before 0.0.33 lets attackers bypass the tool's dangerous-call blocklist by abusing di
Arbitrary code execution in picklescan before 0.0.33 allows remote attackers to bypass the scanner's malicious-pickle de
Security check bypass in PickleScan versions before 0.0.33 allows attackers to smuggle arbitrary code execution payloads
Same weakness CWE-391 – Unchecked Error Condition
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today