Which versions of picklescan are affected by CVE-2025-71342?

picklescan, the security validation tool relied upon to verify PyTorch and ML model safety, contains a detection bypass (CVE-2025-71342) that permits attackers to hide executable code in model files,…. A patch is available.

How to fix or mitigate CVE-2025-71342?

Within 24 hours: Inventory all picklescan deployments and recent model file sources; block non-critical model loading workflows. Within 7 days: Implement layered alternative controls-manual code inspection, sandboxed execution testing, and source whitelisting; isolate picklescan < 0.0.30 from untrusted external models. Within 30 days: Upgrade to picklescan 0.0.30 or later when released; establish mandatory pre-deployment model validation requiring approval from security team.

picklescan CVE-2025-71342

Q: What is the CVSS score of CVE-2025-71342?

CVE-2025-71342 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2025-210410 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-04 VulnCheck

GHSA-j6fw-8849-4cxh

Deserialization RCE Picklescan

7.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-delivered model with no attacker privileges (PR:N) but a victim must load the file (UI:R); successful load yields arbitrary code execution, so C/I/A are High.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 04, 2026 - 03:01 EUVD

Analysis Generated

Jul 04, 2026 - 01:59 vuln.today

DescriptionCVE.org

picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.run.Executive.runcode in reduce methods. Attackers can embed undetected code in pickle files that executes during pickle.load, enabling remote code execution in PyTorch models and supply chain attacks.

AnalysisAI

Malicious pickle detection bypass in picklescan before 0.0.30 lets attackers hide code that runs during pickle.load, because the scanner does not flag the idlelib.run.Executive.runcode primitive used in a reduce method. Since picklescan is a security tool relied upon to vet PyTorch/ML model files, this bypass turns a trusted safety check into a false 'clean' verdict, enabling remote code execution and supply-chain attacks against anyone loading an attacker-supplied model. Reported by VulnCheck; no public exploit identified at time of analysis and not listed in CISA KEV.

Technical ContextAI

picklescan is a Python scanner that inspects Python pickle files for dangerous opcodes/callables before deserialization, commonly used to gate untrusted machine-learning models (PyTorch .pt/.bin, which are pickle-backed). The root cause is CWE-502 (Deserialization of Untrusted Data): Python's pickle executes objects' __reduce__ methods on load, which can name an arbitrary callable. picklescan maintains a denylist of dangerous callables, but it omitted idlelib.run.Executive.runcode - a method in the standard library's IDLE subprocess runner that compiles and executes a code string. A reduce payload referencing that callable therefore passes the scan while still executing on pickle.load. The CPE cpe:2.3:a:picklescan:picklescan:*:*:* confirms the scanner itself is the affected component; the actual code execution occurs in the downstream application (e.g., PyTorch) that deserializes the file.

RemediationAI

Vendor-released patch: upgrade picklescan to version 0.0.30 or later, which adds detection for the idlelib.run.Executive.runcode callable (see advisory GHSA-m869-42cg-3xwr). As a compensating control where immediate upgrade is not possible, do not treat picklescan's verdict as sufficient authorization to deserialize untrusted files: restrict model loading to trusted, integrity-verified sources (signed artifacts, internal registries), and where feasible avoid pickle-based formats entirely by preferring safetensors, which is not code-executing (trade-off: requires model re-export and may not support all object types). You can also sandbox deserialization (isolated container/process with no network and least privilege) so that even a missed payload cannot reach production systems (trade-off: added pipeline complexity and latency). Consult the VulnCheck advisory for detection specifics.