Which versions of picklescan are affected by CVE-2025-71353?

Picklescan, used widely to validate third-party machine learning models, contains a vulnerability that allows attackers to hide malicious code from detection.. A patch is available.

How to fix or mitigate CVE-2025-71353?

WITHIN 24 HOURS: Identify all picklescan deployments and flag systems where it serves as the sole validation gate for external model imports (particularly Hugging Face, public model hubs, third-party research repositories). WITHIN 7 DAYS: Implement compensating controls-migrate new ML pipelines to safer serialization formats (safetensors for PyTorch, ONNX for cross-framework models) to eliminate pickle deserialization risk; enforce sandboxed model loading with minimal privilege levels; deploy secondary validation tools (signature verification, static analysis) as defense-in-depth. Do NOT upgrade picklescan; no patched version is currently available. WITHIN 30 DAYS: Establish formal deprecation timeline for picklescan; monitor vendor advisories for patch availability; evaluate replacement tools; document all interim controls in risk register.

picklescan CVE-2025-71353

Q: What is the CVSS score of CVE-2025-71353?

CVE-2025-71353 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2025-210414 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-04 VulnCheck

GHSA-chm9-4rm6-p4gf

Deserialization Picklescan

7.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-delivered malicious artifact but AC:H and UI:R because the victim must load it in a torch environment relying on picklescan; PR:N as no auth is needed, and full RCE gives C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 04, 2026 - 03:01 EUVD

Analysis Generated

Jul 04, 2026 - 02:06 vuln.today

DescriptionCVE.org

picklescan before 0.0.28 fails to detect malicious pickle files that exploit torch._dynamo.guards.GuardBuilder.get function in reduce methods. Attackers can craft pickle files with embedded code that evades picklescan detection and executes arbitrary commands when loaded.

AnalysisAI

Detection bypass in picklescan before 0.0.28 lets attackers smuggle malicious pickle files past the scanner by abusing the torch._dynamo.guards.GuardBuilder.get gadget inside a __reduce__ method, so a file that picklescan reports as safe still executes arbitrary commands when deserialized (e.g. via torch.load). This undermines the security control that ML pipelines and model hubs rely on to vet untrusted model artifacts, turning a trusted-scan result into a false negative. Reported by VulnCheck with a vendor GHSA advisory; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component (cpe:2.3:a:picklescan:picklescan) is a Python security scanner that statically inspects pickle opcode streams to flag dangerous callables before a model is deserialized. Python's pickle format (CWE-502, Deserialization of Untrusted Data) allows an object to define a __reduce__ method that returns a callable and arguments executed at load time; picklescan works by detecting known-dangerous callables in that stream. This flaw is a gadget-coverage gap: the torch._dynamo.guards.GuardBuilder.get function - part of PyTorch's Dynamo guard machinery - can be reached through a reduce method to obtain code execution, but picklescan's pre-0.0.28 detection logic did not recognize it as a dangerous import, so the crafted stream evades the allow/deny analysis. The actual code-execution primitive lives in PyTorch's deserialization path; picklescan's defect is failing to detect it.

RemediationAI

Vendor-released patch: upgrade picklescan to 0.0.28 or later, which adds detection for the torch._dynamo.guards.GuardBuilder.get gadget; see GHSA-86cj-95qr-2p4f (https://github.com/mmaitre314/picklescan/security/advisories/GHSA-86cj-95qr-2p4f) and the VulnCheck writeup (https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-torch-dynamo-guards-guardbuilder-get). Because the flaw is a scanner blind spot rather than a runtime bug, the strongest compensating control is to stop treating pickle scanning as a sufficient trust boundary: prefer non-executable model formats such as safetensors (trade-off: requires re-exporting or converting existing checkpoints), and load untrusted PyTorch checkpoints with weights_only=True where feasible (trade-off: fails on checkpoints that legitimately pickle non-tensor objects). Additionally, load only models from trusted, integrity-verified sources using signing or hash allowlists, and deserialize untrusted artifacts in a sandboxed or network-isolated environment so a successful reduce-method callback cannot reach sensitive systems (trade-off: added pipeline complexity and latency).