Which versions of picklescan are affected by CVE-2025-71347?

picklescan, which organizations use to prevent malicious machine learning models from executing during model loading, can be bypassed in all current versions.. A patch is available.

How to fix or mitigate CVE-2025-71347?

Within 24 hours: audit all systems using picklescan versions before 0.0.33 to identify deployment scope and pickle file sources. Within 7 days: implement input validation restrictions (whitelist trusted model sources, disable pickle format where feasible, enforce network segmentation for ML pipeline infrastructure). Within 30 days: establish upgrade plan for picklescan 0.0.33+ when released and subscribe to vendor security advisories for patch timeline.

picklescan CVE-2025-71347

Q: What is the CVSS score of CVE-2025-71347?

CVE-2025-71347 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2025-210413 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-04 VulnCheck

GHSA-pqxv-q4c6-wh8q

Deserialization RCE Picklescan

7.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

Network-delivered file but AC:H and UI:R because the victim must both scan with picklescan and then unpickle with NumPy present; RCE gives C:H/I:H, no direct availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 04, 2026 - 03:01 EUVD

Analysis Generated

Jul 04, 2026 - 02:04 vuln.today

DescriptionCVE.org

picklescan before 0.0.33 fails to detect malicious pickle files using numpy.f2py.crackfortran.param_eval function in reduce methods, allowing attackers to bypass security checks. Remote attackers can embed undetected code in pickle files that executes during deserialization, enabling arbitrary code execution in applications loading untrusted pickle data.

AnalysisAI

Security-scanner evasion in picklescan before 0.0.33 lets attackers smuggle malicious pickle files past its detection engine by abusing the numpy.f2py.crackfortran.param_eval function inside a pickle reduce method, so a payload the scanner declares safe still triggers arbitrary code execution when the application deserializes it. This defeats the exact protection picklescan exists to provide, endangering ML pipelines that rely on it to vet untrusted model/pickle files (e.g., Hugging Face-style workflows). No public exploit is identified at time of analysis and it is not in CISA KEV, though VulnCheck published an advisory.

Technical ContextAI

picklescan is a Python security tool that statically inspects pickle files for dangerous opcodes and known code-execution gadgets before an application unpickles them. Python's pickle format is inherently unsafe (CWE-502, Deserialization of Untrusted Data) because the REDUCE opcode invokes arbitrary callables during load; scanners like picklescan work by allow/deny-listing the callables referenced in reduce methods. This flaw is a gap in that deny-list: numpy.f2py.crackfortran.param_eval is a legitimate NumPy internal that evaluates expressions, and because picklescan did not recognize it as dangerous, a reduce tuple pointing at param_eval passes inspection while still executing attacker-controlled code at deserialization. The affected component is picklescan itself (cpe:2.3:a:picklescan:picklescan:*), and exploitation additionally depends on NumPy being importable in the victim environment.

RemediationAI

Vendor-released patch: upgrade picklescan to 0.0.33 or later (e.g., pip install --upgrade 'picklescan>=0.0.33'), which adds detection for the numpy.f2py.crackfortran.param_eval gadget; consult GHSA-cffc-mxrf-mhh4 and the VulnCheck advisory for details. Because this is a detection-bypass, do not treat a passing picklescan result on older versions as trustworthy - until upgraded, avoid unpickling any file solely on picklescan's approval. As compensating controls, prefer safe serialization formats (safetensors) over pickle for untrusted model artifacts, load untrusted pickles only in a sandboxed/least-privilege environment (containerized, no network, restricted filesystem) to contain any execution, and restrict pickle intake to trusted/signed sources; the trade-off is added workflow friction and possible incompatibility with pickle-only model files.