Which versions of picklescan are affected by CVE-2025-71361?

picklescan, a security tool for validating PyTorch model integrity in machine learning supply chains, contains a detection bypass vulnerability (CVE-2025-71361) that allows malicious pickle files to…. A patch is available.

How to fix or mitigate CVE-2025-71361?

Within 24 hours: Inventory all deployments of picklescan and identify which models have been validated using vulnerable versions (before 0.0.29). Within 7 days: Implement compensating controls including manual source verification of PyTorch models and restrict model loading to trusted internal sources only. Within 30 days: Monitor vendor advisories and plan deployment of patched versions (0.0.29 or later) when released; re-validate any models processed by vulnerable versions.

picklescan CVE-2025-71361

Q: What is the CVSS score of CVE-2025-71361?

CVE-2025-71361 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2025-210328 HIGH

Eval Injection (CWE-95)

2026-06-24 VulnCheck

Code Injection RCE Picklescan

7.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-delivered malicious file with low complexity and no auth, but requires the victim to scan-then-load (UI:R); full code execution gives C/I/A:H.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jun 24, 2026 - 13:01 EUVD

Source Code Evidence Fetched

Jun 24, 2026 - 12:16 vuln.today

Analysis Generated

Jun 24, 2026 - 12:16 vuln.today

DescriptionCVE.org

picklescan before 0.0.29 fails to detect malicious idlelib.calltip.Calltip.fetch_tip calls in pickle files, allowing remote code execution. Attackers can embed undetected payloads in pickle files that execute arbitrary code when loaded via pickle.load().

AnalysisAI

Detection bypass in picklescan before 0.0.29 allows malicious pickle files to evade scanning by abusing the undetected idlelib.calltip.Calltip.fetch_tip function, enabling arbitrary code execution when the file is later loaded via pickle.load(). Affects ML supply chains relying on picklescan to vet PyTorch models; publicly available exploit code exists in the GHSA advisory, but no public exploit identified in active campaigns at time of analysis.

Technical ContextAI

picklescan is a Python library used to statically inspect pickle files (commonly distributed inside PyTorch/Hugging Face model artifacts) for invocations of dangerous callables before they are deserialized. The flaw is a classic CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code) gap in picklescan's blocklist: idlelib.calltip.Calltip.fetch_tip internally calls get_entity(), which passes its argument to eval(). Because this function lives in Python's standard idlelib package, it is reachable on any default Python installation, yet was not enumerated in picklescan's dangerous-function list prior to 0.0.29 (CPE cpe:2.3:a:picklescan:picklescan:*).

RemediationAI

Vendor-released patch: upgrade picklescan to 0.0.29 or later (pip install --upgrade 'picklescan>=0.0.29'); the fix corresponds to upstream commit aecd11be98702caa9ba9b12189d91ad596a36114, which extends the dangerous-globals list to cover idlelib.calltip.Calltip.fetch_tip. Until the upgrade is rolled out across all scanning hosts, treat any picklescan verdict from older versions as untrusted and refuse to pickle.load() files from untrusted sources; for organizations that cannot upgrade immediately, a workable compensating control is to load model weights through safer formats such as safetensors (which removes the pickle attack surface entirely) or to run pickle.load only inside a hardened sandbox (gVisor, Firejail, ephemeral container with no network/secrets), accepting the latency and tooling cost. Consult the GHSA advisory (https://github.com/mmaitre314/picklescan/security/advisories/GHSA-8r4j-24qv-fmq9) for the authoritative fix details.