Which versions of picklescan are affected by CVE-2025-71356?

Picklescan, a defensive security tool widely used to vet untrusted ML models in the Hugging Face ecosystem and beyond, contains a bypass vulnerability allowing attackers to smuggle malicious code…. A patch is available.

How to fix or mitigate CVE-2025-71356?

Within 24 hours: Identify all systems running picklescan and audit recent external model imports; disable picklescan for high-risk environments and quarantine any models obtained before this advisory date. Within 7 days: Deploy alternative model validation methods (manual code inspection, sandboxing, or third-party scanning tools); document all external model sources and assess which models were processed by vulnerable picklescan versions. Within 30 days: Monitor vendor advisory for patch availability and test deployment path; conduct retrospective security assessment of models previously validated by picklescan to identify potential compromise.

picklescan CVE-2025-71356

Q: What is the CVSS score of CVE-2025-71356?

CVE-2025-71356 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2025-210415 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-04 VulnCheck

GHSA-gpmh-464g-j3r8

Deserialization Picklescan

7.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

Network-delivered malicious file with high confidentiality/integrity impact, but AC:H and UI:R because success depends on the victim relying on picklescan and then unpickling the file.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 04, 2026 - 03:01 EUVD

Analysis Generated

Jul 04, 2026 - 02:08 vuln.today

DescriptionCVE.org

picklescan before 0.0.28 fails to detect malicious torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression function calls in pickle files. Attackers can embed undetected code in pickle files that executes remote code when loaded by victims.

AnalysisAI

Security scanner bypass in picklescan before 0.0.28 allows attackers to smuggle arbitrary code past the tool's malware detection by abusing torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression, which is not on picklescan's dangerous-globals blocklist. Because picklescan is a defensive tool used to vet untrusted ML pickle files (notably in the Hugging Face ecosystem), a bypass causes a malicious model to be marked safe and then execute remote code when the victim deserializes it. There is no public exploit identified at time of analysis and this CVE is not listed in CISA KEV, but the technique is fully described in the VulnCheck advisory.

Technical ContextAI

picklescan is a Python static-analysis utility that inspects Python pickle streams for references to dangerous callables (globals) before a user unpickles an untrusted file, a common defense for machine-learning model files (.pt/.bin/.pkl) that are natively pickle-serialized. CWE-502 (Deserialization of Untrusted Data) is the root class: Python's pickle can invoke arbitrary importable callables during load via REDUCE/GLOBAL opcodes. picklescan works from a denylist of known-dangerous functions, and this flaw is a denylist gap - torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression evaluates attacker-controllable expressions but was not recognized as dangerous, so pickles invoking it pass the scan yet still achieve code execution when loaded through PyTorch. The affected component is picklescan itself (cpe:2.3:a:picklescan:picklescan), not PyTorch; PyTorch is merely the vehicle supplying the abusable gadget.

RemediationAI

Upgrade picklescan to version 0.0.28 or later, which adds detection for the torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression gadget (Vendor-released patch: 0.0.28); see GHSA-f4x7-rfwp-v3xw. Because this is a denylist-completeness bug, treat picklescan's verdict as advisory rather than authoritative: where feasible, avoid loading untrusted pickles entirely and prefer non-executable serialization such as safetensors for model weights, which eliminates the deserialization code-execution class rather than merely scanning for it. As compensating controls until every scanning host is upgraded, unpickle untrusted files only inside a sandboxed/network-isolated process with least privilege so that a bypass yields no useful execution context, and quarantine or re-scan already-ingested models that passed an older picklescan version - the trade-off is added pipeline latency and, for safetensors migration, re-exporting existing model artifacts.