picklescan
CVE-2025-71325
CRITICAL
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered malicious pickle, no attacker auth, but a victim must load the file (UI:R); scope changes because the scanner's failure causes RCE in a separate loader process with full C/I/A impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
picklescan before 0.0.27 contains a parsing logic error in the _list_globals function when handling STACK_GLOBAL opcodes, failing to track arguments in the correct range and allowing malicious pickle files to bypass detection. Attackers can craft pickle files with arguments at position zero to trigger unexpected exceptions and evade security scanning.
AnalysisAI
Detection bypass in picklescan versions prior to 0.0.27 allows attackers to smuggle malicious Python pickle files past the scanner by exploiting an off-by-one parsing error in STACK_GLOBAL opcode handling. The flaw, reported by VulnCheck and tracked under GHSA-9gvj-pp9x-gcfr, lets crafted pickles trigger an unexpected exception in _list_globals so dangerous imports such as os.system go unflagged; a working PoC is published in the advisory and a vendor patch is available, though no public exploitation against deployments has been observed.
Technical ContextAI
picklescan is a Python library used to statically scan pickle files for unsafe globals before deserialization, and the same parsing logic was reused by modelscan and by Hugging Face's online pickle scanners. In scanner.py the _list_globals function walks pickle opcodes and, when it sees a STACK_GLOBAL opcode at position n, must locate the two preceding string arguments that name the module and attribute being resolved. The buggy code iterates range(1, n), which excludes position 0, so an attacker who places the first string argument at offset 0 makes the scanner find only one of the two expected arguments and raise an exception that aborts inspection of that opcode rather than logging os.system or similar dangerous globals. CWE-391 (Unchecked Error Condition) captures the root cause: the parser treats its own failure to parse as benign instead of treating an unparseable STACK_GLOBAL as suspicious. CPE coverage is limited to cpe:2.3:a:picklescan:picklescan:*, but the GHSA notes the same logic flaw impacts modelscan and Hugging Face's hosted scanners.
RemediationAI
Vendor-released patch: upgrade picklescan to 0.0.27 or later (pip install --upgrade picklescan>=0.0.27); the corrective change in commit 2a8383cfeb4158567f9770d86597300c9e508d0f fixes the iteration range in _list_globals so that the argument at position 0 is tracked. Confirm any downstream wrappers - notably modelscan and self-hosted forks of the Hugging Face scanner - have either upgraded their picklescan dependency or applied the equivalent range(1, n+1) fix before trusting their verdicts again. As a compensating control until upgrade is complete, treat picklescan/modelscan results as advisory only and either refuse to deserialize third-party pickles outright, transcode models through a safer format such as safetensors before loading, or run pickle.load only inside a sandboxed, network-isolated worker - each of these stops downstream RCE but breaks workflows that rely on transparent pickle ingestion. Monitor for picklescan exceptions or parse errors in scanner logs and reject the file rather than allow-listing on parser failure, since the bypass manifests precisely as an unhandled exception during scan.
More in Picklescan
View allAn Improper Handling of Exceptional Conditions vulnerability in the ZIP archive scanning component of mmaitre314 pickles
A Protection Mechanism Failure vulnerability in mmaitre314 picklescan versions up to and including 0.0.30 allows a remot
An Improper Input Validation vulnerability in the scanning logic of mmaitre314 picklescan versions up to and including 0
Detection bypass in picklescan prior to 0.0.29 allows attackers to smuggle remote code execution payloads through pickle
Detection bypass in picklescan versions before 0.0.25 allows attackers to embed remote code execution payloads in pickle
Detection bypass in picklescan before 0.0.28 allows attackers to embed malicious torch.jit.unsupported_tensor_ops.execWr
Detection bypass in picklescan before 0.0.28 allows attackers to smuggle arbitrary code through pickle files by abusing
Detection bypass in picklescan before 0.0.29 allows malicious pickle files to evade scanning by abusing the undetected i
Detection bypass in picklescan versions before 0.0.30 allows malicious pickle files to evade security scanning by using
Detection bypass in picklescan versions prior to 0.0.29 allows attackers to smuggle arbitrary code execution payloads th
Detection bypass in picklescan before 0.0.33 allows attackers to smuggle arbitrary code through malicious pickle files b
Detection bypass in picklescan before 0.0.29 allows attackers to craft malicious pickle files using idlelib.debugobj.Obj
Same weakness CWE-391 – Unchecked Error Condition
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today