EUVD-2025-210327Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconCraft pickle with ObjectTreeItem.SetText __reduce__ payload
-
DeliveryPublish model to hub or send to victim
-
ExploitVictim runs picklescan and gets clean verdict
-
InstallVictim invokes pickle.load/torch.load
-
C2idlelib SetText resolves attacker callable
-
Executeos.system executes payload
-
ImpactRCE in ML pipeline context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that (1) the target organisation uses picklescan < 0.0.29 as its safety check on pickle files, (2) a user is induced to load an attacker-supplied pickle file via pickle.load(), torch.load(), joblib.load() or equivalent (UI:P - user interaction is required to deserialise), and (3) the victim's Python environment has the idlelib standard-library module importable, which is the default on CPython desktop and most server distributions but may be absent in stripped-down container images that exclude tkinter/idle. No authentication to the picklescan tool is needed (PR:N) and no special picklescan configuration is required - the bypass works against default scan settings. The attack does not work if the victim never deserialises the file, or if their stdlib has idlelib removed. |
| Impact | The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N) scores 7.6 and accurately reflects that exploitation requires a passive attacker requirement (AT:P - the victim must consume an attacker-supplied pickle) plus user interaction (UI:P - the victim must call pickle.load on the file). EPSS and KEV data are not present in the input, so widespread opportunistic exploitation cannot be confirmed; however, a working PoC is published in the GHSA, lowering the skill barrier substantially. The realistic risk is concentrated in ML/AI organisations that rely on picklescan as a gating control for third-party models from Hugging Face or similar hubs - for those, this is high priority because the tool produces a clean verdict on a weaponised file. For organisations that do not use picklescan, the CVE is informational. |
| Exploit ScenarioDerived | An attacker publishes a PyTorch model (.pt/.pkl) to a public model hub with an embedded __reduce__ that returns ObjectTreeItem('label', None, print).SetText with an os.system payload, as shown in the published PoC. A defender runs picklescan against the file, receives a clean verdict, and loads it with torch.load / pickle.load in a training or inference pipeline; the payload executes as the loading process, giving the attacker code execution on the ML host. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 24, 2026
Detection bypass in picklescan before 0.0.29 allows attackers to craft malicious pickle files using idlelib.debugobj.ObjectTreeItem.SetText in __reduce__ methods that evade the scanner's dangerous-function checks, resulting in arbitrary command execution when the victim subsequently calls pickle.load(). The flaw turns picklescan from a security control into a false-assurance tool for ML pipelines that consume untrusted PyTorch models. Publicly available exploit code exists via the GHSA advisory, though no public exploit identified in active campaigns at time of analysis.
RemediationAI
Vendor-released patch: upgrade picklescan to 0.0.29 or later (pip install --upgrade picklescan>=0.0.29), which adds idlelib.debugobj.ObjectTreeItem.SetText to the denylist per commit aecd11be98702caa9ba9b12189d91ad596a36114 referenced in GHSA-3vg9-h568-4w9m. Until upgraded, treat picklescan output as advisory rather than authoritative: refuse pickle-format model files from untrusted sources and require safetensors equivalents where available (trade-off: not all upstream models publish safetensors weights, so some HF integrations may break). As a structural mitigation, load suspect pickles only inside an unprivileged sandbox or ephemeral container with no outbound network and read-only filesystem so that a successful __reduce__ payload cannot pivot - note that this adds latency to model-loading pipelines and may need orchestrator changes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
picklescan is a Python library that statically inspects pickle streams to flag dangerous opcodes and known-bad callables before pickle.load() is invoked, commonly used in ML supply chains to vet PyTorch model files. CWE-502 (Deserialization of Untrusted Data) is the root cause: picklescan maintains an allow/deny list of callables, but idlelib.debugobj.ObjectTreeItem.SetText - a method exposed by the stdlib IDLE debugger - was not in its denylist despite being a usable code-execution sink when wrapped in __reduce__. The CPE cpe:2.3:a:picklescan:picklescan:*:*:* identifies the pip-distributed picklescan package as the affected component; the underlying pickle protocol and idlelib remain unchanged.
Know when Picklescan gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Network-delivered malicious pickle (AV:N), no auth to the scanner (PR:N), but victim must deserialise the file (UI:R); successful RCE yields full host impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.debugobj.ObjectTreeItem.SetText function in reduce methods. Attackers can craft pickle files with embedded code that bypasses picklescan detection and executes arbitrary commands when pickle.load() is called.
Executive ViewAI
picklescan, a security scanning tool for validating PyTorch models in ML pipelines, contains a detection bypass allowing attackers to craft malicious pickle files that evade security checks and achieve arbitrary code execution; publicly available exploit code exists. Organizations relying on picklescan as a primary defense mechanism now operate with a false sense of security while remaining vulnerable to model-based attacks.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Execute pickle.load() operations in sandboxed containers with minimal privileges; (2) Require cryptographic code-signing validation for PyTorch models before loading; (3) Implement network isolation for systems processing untrusted models; (4) Disable picklescan if currently relied upon as primary security control.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
More in Picklescan
View allRemote code execution against users of picklescan versions prior to 1.0.4 is achievable by smuggling any blocked functio
An Improper Handling of Exceptional Conditions vulnerability in the ZIP archive scanning component of mmaitre314 pickles
A Protection Mechanism Failure vulnerability in mmaitre314 picklescan versions up to and including 0.0.30 allows a remot
An Improper Input Validation vulnerability in the scanning logic of mmaitre314 picklescan versions up to and including 0
Detection bypass in picklescan prior to 0.0.29 allows attackers to smuggle remote code execution payloads through pickle
Detection bypass in picklescan versions before 0.0.25 allows attackers to embed remote code execution payloads in pickle
Detection bypass in picklescan before 0.0.28 allows attackers to embed malicious torch.jit.unsupported_tensor_ops.execWr
Detection bypass in picklescan before 0.0.28 allows attackers to smuggle arbitrary code through pickle files by abusing
Detection bypass in picklescan before 0.0.29 allows malicious pickle files to evade scanning by abusing the undetected i
Detection bypass in picklescan versions before 0.0.30 allows malicious pickle files to evade security scanning by using
Detection bypass in picklescan versions prior to 0.0.29 allows attackers to smuggle arbitrary code execution payloads th
Detection bypass in picklescan before 0.0.33 allows attackers to smuggle arbitrary code through malicious pickle files b
Exploit-DB