Which versions of picklescan are affected by CVE-2025-71354?

picklescan, a security scanning tool for validating PyTorch models in ML pipelines, contains a detection bypass allowing attackers to craft malicious pickle files that evade security checks and…. A patch is available.

How to fix or mitigate CVE-2025-71354?

Within 24 hours: Identify and document all systems using picklescan for security validation. Within 7 days: Implement compensating controls including process isolation for model loading, cryptographic verification of model sources, and network segmentation of ML systems. Within 30 days: Evaluate alternative model validation solutions and develop a timeline to reduce dependency on picklescan pending vendor remediation.

picklescan CVE-2025-71354

Q: What is the CVSS score of CVE-2025-71354?

CVE-2025-71354 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2025-210327 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-24 VulnCheck

Deserialization Picklescan

7.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-delivered malicious pickle (AV:N), no auth to the scanner (PR:N), but victim must deserialise the file (UI:R); successful RCE yields full host impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jun 24, 2026 - 13:01 EUVD

Source Code Evidence Fetched

Jun 24, 2026 - 12:15 vuln.today

Analysis Generated

Jun 24, 2026 - 12:15 vuln.today

DescriptionCVE.org

picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.debugobj.ObjectTreeItem.SetText function in reduce methods. Attackers can craft pickle files with embedded code that bypasses picklescan detection and executes arbitrary commands when pickle.load() is called.

AnalysisAI

Detection bypass in picklescan before 0.0.29 allows attackers to craft malicious pickle files using idlelib.debugobj.ObjectTreeItem.SetText in __reduce__ methods that evade the scanner's dangerous-function checks, resulting in arbitrary command execution when the victim subsequently calls pickle.load(). The flaw turns picklescan from a security control into a false-assurance tool for ML pipelines that consume untrusted PyTorch models. Publicly available exploit code exists via the GHSA advisory, though no public exploit identified in active campaigns at time of analysis.

Technical ContextAI

picklescan is a Python library that statically inspects pickle streams to flag dangerous opcodes and known-bad callables before pickle.load() is invoked, commonly used in ML supply chains to vet PyTorch model files. CWE-502 (Deserialization of Untrusted Data) is the root cause: picklescan maintains an allow/deny list of callables, but idlelib.debugobj.ObjectTreeItem.SetText - a method exposed by the stdlib IDLE debugger - was not in its denylist despite being a usable code-execution sink when wrapped in __reduce__. The CPE cpe:2.3:a:picklescan:picklescan:*:*:* identifies the pip-distributed picklescan package as the affected component; the underlying pickle protocol and idlelib remain unchanged.

RemediationAI

Vendor-released patch: upgrade picklescan to 0.0.29 or later (pip install --upgrade picklescan>=0.0.29), which adds idlelib.debugobj.ObjectTreeItem.SetText to the denylist per commit aecd11be98702caa9ba9b12189d91ad596a36114 referenced in GHSA-3vg9-h568-4w9m. Until upgraded, treat picklescan output as advisory rather than authoritative: refuse pickle-format model files from untrusted sources and require safetensors equivalents where available (trade-off: not all upstream models publish safetensors weights, so some HF integrations may break). As a structural mitigation, load suspect pickles only inside an unprivileged sandbox or ephemeral container with no outbound network and read-only filesystem so that a successful __reduce__ payload cannot pivot - note that this adds latency to model-loading pipelines and may need orchestrator changes.