Which versions of picklescan are affected by CVE-2025-71352?

picklescan before version 0.0.29 contains a detection bypass vulnerability that allows malicious machine learning models to be falsely marked as safe, then execute arbitrary code when loaded.. A patch is available.

How to fix or mitigate CVE-2025-71352?

Within 24 hours: Inventory all systems using picklescan and notify ML/data engineering teams of the detection bypass. Within 7 days: Implement compensating controls (manual security review, sandboxed model loading, source restrictions) for all untrusted pickle files until a patch is available. Within 30 days: Monitor picklescan releases for version 0.0.29 or later; establish a procurement requirement for actively maintained alternatives if no patch materializes.

picklescan CVE-2025-71352

Q: What is the CVSS score of CVE-2025-71352?

CVE-2025-71352 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2025-210387 HIGH

Protection Mechanism Failure (CWE-693)

2026-06-30 VulnCheck

GHSA-rf4j-9c72-qfw6

Python RCE Picklescan

7.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

Remote unauthenticated delivery (AV:N/PR:N), but AC:H/UI:R because success depends on the victim scanning with picklescan and then loading the file; code execution yields C:H/I:H, no availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 01, 2026 - 02:16 EUVD

Analysis Generated

Jun 30, 2026 - 23:29 vuln.today

DescriptionCVE.org

picklescan before 0.0.29 fails to detect the built-in Python trace.Trace.runctx function when used in pickle file reduce methods, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files with trace.Trace.runctx payloads that bypass picklescan detection and execute code upon pickle.load() invocation.

Articles & Coverage 1

News 5 New Python Vulnerabilities - 2 Critical, 3 High Severity Jul 01, 2026

AnalysisAI

Detection bypass in picklescan before 0.0.29 allows attackers to smuggle arbitrary-code payloads past the scanner by abusing Python's built-in trace.Trace.runctx in a pickle reduce method, so a malicious model/pickle file is rated safe yet executes code when later deserialized with pickle.load(). picklescan is a security scanner used to vet untrusted ML pickle files (notably in the Hugging Face ecosystem), so this failure defeats the very control teams rely on to catch malicious models. No public exploit identified at time of analysis and the issue is not in CISA KEV; reported by VulnCheck with a CVSS 4.0 base score of 7.6.

Technical ContextAI

Python's pickle format permits objects to define a __reduce__ method that returns a callable plus arguments to be invoked during deserialization, which is the long-standing mechanism behind pickle RCE. picklescan works by inspecting the opcode/import stream of a pickle and blocklisting known dangerous callables, but it maintained an incomplete inventory: it did not flag trace.Trace.runctx, a standard-library function that executes a code statement within a given global/local namespace. By routing the malicious callable through trace.Trace.runctx, an attacker satisfies the reduce contract while evading the scanner's dangerous-import checks. The root cause maps to CWE-693 (Protection Mechanism Failure) - the security control exists but can be circumvented because its detection list is not exhaustive. The single affected component is the picklescan package itself (cpe:2.3:a:picklescan:picklescan).

RemediationAI

Vendor-released patch: 0.0.29 - upgrade picklescan to 0.0.29 or later (for example, pip install --upgrade 'picklescan>=0.0.29') as the primary fix, per GHSA-g344-hcph-8vgg. Until upgraded, treat picklescan results on untrusted files as unreliable: avoid calling pickle.load() on any externally sourced model/pickle and prefer safe serialization formats such as safetensors, or load models only inside a sandboxed/network-restricted environment so that a bypassed payload cannot reach sensitive data - the trade-off being added pipeline friction and conversion effort. As a compensating control, supplement picklescan with a second independent scanner or an allowlist of permitted opcodes/callables rather than relying on any single blocklist-based tool, accepting that this increases scanning time and may produce false positives. Reference the maintainer advisory (https://github.com/mmaitre314/picklescan/security/advisories/GHSA-g344-hcph-8vgg) and VulnCheck advisory (https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-undetected-trace-trace-runctx-in-pickle-files).