Which versions of picklescan are affected by CVE-2025-71349?

picklescan, a widely-deployed security scanner for validating untrusted machine learning artifacts, contains a bypass flaw that allows attackers to smuggle arbitrary code execution through pickle…. A patch is available.

How to fix or mitigate CVE-2025-71349?

24 hours: Inventory all picklescan deployments and document current versions in use across ML platforms and artifact repositories. 7 days: Verify no patch is available from picklescan maintainers; implement compensating controls such as sandboxed model loading environments and restrict model sources to vetted repositories. 30 days: Monitor picklescan releases for security patches and establish a tested upgrade procedure; review model loading logs for anomalous deserialization activity.

picklescan CVE-2025-71349

Q: What is the CVSS score of CVE-2025-71349?

CVE-2025-71349 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2025-210385 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-30 VulnCheck

GHSA-3cjr-683m-5fxh

Deserialization RCE Picklescan

7.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network-delivered malicious file with no privileges but requiring the victim to load it (UI:R); arbitrary code execution gives C:H/I:H, with no direct availability impact and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 01, 2026 - 02:16 EUVD

Analysis Generated

Jun 30, 2026 - 23:30 vuln.today

DescriptionCVE.org

picklescan before 0.0.29 fails to detect the built-in trace.Trace.run function when analyzing pickle files, allowing attackers to embed undetected malicious code. Remote attackers can craft malicious pickle files using trace.Trace.run in the reduce method to achieve arbitrary code execution when pickle.load processes the file.

AnalysisAI

Malicious pickle detection bypass in picklescan before 0.0.29 lets attackers smuggle arbitrary code execution payloads past the scanner by abusing the built-in trace.Trace.run function inside a pickle's __reduce__ method. Because picklescan does not flag trace.Trace.run as a dangerous global, a crafted model/pickle file is reported as safe yet executes arbitrary code when later deserialized via pickle.load. No public exploit identified at time of analysis; this is a classic deny-list gap in a security scanner that defenders rely on to gate untrusted ML artifacts.

Technical ContextAI

picklescan is a Python security tool that statically inspects pickle (and pickle-based ML model) files for references to dangerous callables before they are unpickled, and is used in ML supply-chain workflows to screen untrusted models. Python's pickle format is inherently code-executing: the __reduce__ protocol lets an object specify a callable and arguments invoked at load time, which is the basis of CWE-502 (Deserialization of Untrusted Data). picklescan defends against this by matching imported globals against a blocklist of known-dangerous functions (os.system, eval, etc.). The root cause here is an incomplete blocklist: the standard-library trace.Trace.run callable, which executes a passed code/command string, was not enumerated as dangerous, so an attacker placing trace.Trace.run in the reduce tuple slips through undetected while still yielding execution on pickle.load. The CPE cpe:2.3:a:picklescan:picklescan:*:*:* confirms the affected component is picklescan itself across all versions prior to the fix.

RemediationAI

Vendor-released patch: upgrade picklescan to version 0.0.29 or later, which adds trace.Trace.run to the dangerous-globals detection set (see GHSA-5qwp-399c-mjwf and the VulnCheck advisory linked above). As a compensating control where immediate upgrade is not possible, do not treat a clean picklescan result from an old version as authoritative: avoid pickle.load on any untrusted or third-party model file, and prefer safer serialization formats such as safetensors for ML weights, which trade some flexibility for eliminating arbitrary-code execution. Additionally, unpickle untrusted artifacts only inside a sandboxed, network-restricted, least-privilege environment so that a bypass does not translate into host compromise; the trade-off is added pipeline complexity and the loss of pickle's convenience for arbitrary Python objects.