Which versions of Python are affected by CVE-2025-71340?

picklescan, a tool organizations deploy to validate the safety of PyTorch models and serialized Python objects before deployment, contains a detection bypass that allows arbitrary command…. A patch is available.

How to fix or mitigate CVE-2025-71340?

Within 24 hours: identify all models validated by picklescan (versions ≤0.0.26) and audit whether picklescan output influenced deployment decisions. Within 7 days: implement compensating controls-sandbox all pickle deserialization in isolated containers with no network access, restrict model sources to signed repositories with human review, and stop treating picklescan as a security boundary. Within 30 days: monitor picklescan for a patched release; do not resume reliance on picklescan as a security control until vendor confirms the vulnerability is fixed and provides the corrected version number.

Python CVE-2025-71340

Q: What is the CVSS score of CVE-2025-71340?

CVE-2025-71340 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2025-210344 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-25 VulnCheck

GHSA-mq7r-vm99-p7vx

Deserialization Python Picklescan

7.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 25, 2026 - 22:36 vuln.today

Analysis Generated

Jun 25, 2026 - 22:36 vuln.today

DescriptionCVE.org

picklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.ModifiedInterpreter.runcode in __reduce__ methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when the file is loaded via pickle.load(), enabling supply chain attacks on PyTorch models and saved Python objects. This is fixed in version 0.0.30.

Articles & Coverage 1

News 4 New Python Vulnerabilities - 1 Critical, 3 High Severity Jun 26, 2026

AnalysisAI

Detection bypass in picklescan through version 0.0.26 lets attackers smuggle malicious pickle payloads past the scanner by invoking idlelib.pyshell.ModifiedInterpreter.runcode from a __reduce__ method, which picklescan does not blocklist. Because organizations rely on picklescan to vet PyTorch models and serialized Python objects, a payload it marks 'safe' still achieves arbitrary command execution the moment the victim calls pickle.load(), enabling ML supply-chain attacks. Publicly available exploit code exists (GHSA-3gf5-cxq9-w223 ships a working PoC); the CVE is not in CISA KEV and EPSS data was not provided, so active exploitation is unconfirmed.