Which versions of picklescan are affected by CVE-2025-71345?

picklescan before version 0.0.30 contains a detection bypass (CVE-2025-71345) that allows attackers to deliver remote code execution payloads disguised as safe ML model files.. A patch is available.

How to fix or mitigate CVE-2025-71345?

24 hours: Identify all systems running picklescan versions before 0.0.30; audit which applications accept untrusted ML model inputs; immediately restrict model loading to pre-approved sources only. 7 days: Implement compensating controls including sandboxed deserialization environments and supplementary model validation layers; monitor GHSA-4whj-rm5r-c2v8 and picklescan releases for patch availability. 30 days: Deploy picklescan 0.0.30 or later when available; evaluate secondary model validation tools to eliminate single-point-of-failure dependency on picklescan.

picklescan CVE-2025-71345

Q: What is the CVSS score of CVE-2025-71345?

CVE-2025-71345 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2025-210412 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-04 VulnCheck

GHSA-vwrw-h95r-ch46

Deserialization RCE Picklescan

7.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

AC:H because exploitation depends on the victim routing an untrusted model through vulnerable picklescan and having torch importable; UI:R for the victim loading the file; full RCE gives C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 04, 2026 - 03:01 EUVD

Analysis Generated

Jul 04, 2026 - 02:02 vuln.today

DescriptionCVE.org

picklescan before 0.0.30 fails to detect malicious pickle files that invoke torch.utils.bottleneck.__main__.run_autograd_prof function. Attackers can embed undetected code in pickle files that executes during deserialization, enabling remote code execution.

AnalysisAI

Malicious-pickle detection bypass in picklescan before 0.0.30 allows attackers to smuggle undetected remote code execution payloads past the scanner by abusing the torch.utils.bottleneck.__main__.run_autograd_prof gadget, which was absent from picklescan's dangerous-import blocklist. Because picklescan is used as a security gate to vet untrusted ML model files, a false-negative here means a crafted model passes as safe and executes arbitrary code when subsequently deserialized. Reported by VulnCheck via GHSA-4whj-rm5r-c2v8; no public exploit identified at time of analysis, and it is not on CISA KEV.

Technical ContextAI

picklescan is a Python security tool that statically inspects Python pickle files (commonly PyTorch .bin/.pt model weights) for calls to known-dangerous callables before a user loads them. The weakness is CWE-502 (Deserialization of Untrusted Data) applied at the scanner layer: pickle's opcode stream can invoke arbitrary importable callables during unpickling, and picklescan relies on a blocklist of such callables. The torch.utils.bottleneck.__main__.run_autograd_prof function - part of PyTorch's bottleneck profiling utility - was not enumerated in that blocklist, so a REDUCE/GLOBAL opcode referencing it evaded detection. The only affected product per CPE is cpe:2.3:a:picklescan:picklescan (all versions before 0.0.30); the downstream impact lands on any host that unpickles the file, typically a PyTorch/ML pipeline.

RemediationAI

Upgrade picklescan to version 0.0.30 or later, which adds torch.utils.bottleneck.__main__.run_autograd_prof to its detection set (Vendor-released patch: 0.0.30); pin this minimum in requirements/lockfiles and rebuild any container images or CI/CD scanners that bundle the library. Follow the fix per GHSA-4whj-rm5r-c2v8 and the VulnCheck advisory linked above. Because this is a detection-bypass rather than a code-execution bug in picklescan itself, do not treat the scanner as a sole control: prefer loading models with a safe format (safetensors) instead of pickle, and where pickle is unavoidable, deserialize untrusted models only in a sandboxed, network-isolated, least-privilege environment. As a compensating control until upgrade, block or quarantine externally sourced .bin/.pt/.pkl model files and require provenance/signature verification of model artifacts - the trade-off is added friction ingesting third-party models from hubs.