Which versions of picklescan are affected by CVE-2025-71369?

picklescan, the primary safety screening tool for untrusted ML models on Hugging Face and similar platforms, contains a detection bypass allowing attackers to hide malicious code in files that report…. A patch is available.

How to fix or mitigate CVE-2025-71369?

24 hours: Alert security and data science teams; discontinue treating picklescan output as definitive security validation; pause automated model deployment workflows dependent on picklescan. 7 days: Audit all models processed by picklescan versions before 0.0.28; isolate model execution in restricted containers; disable unsafe pickle deserialization where operationally feasible. 30 days: Monitor picklescan for patched release and upgrade when available; implement cryptographic signature verification for trusted model sources; establish multi-stage validation gates requiring independent verification before production model deployment.

picklescan CVE-2025-71369

Q: What is the CVSS score of CVE-2025-71369?

CVE-2025-71369 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2025-210422 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-04 VulnCheck

GHSA-gphx-c88f-73gw

Deserialization RCE Picklescan

7.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

Network-delivered file but success needs the victim to scan-then-load a crafted model (UI:R) and depends on the specific unlisted gadget and PyTorch presence (AC:H); code execution yields C:H/I:H, no availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 04, 2026 - 03:01 EUVD

Analysis Generated

Jul 04, 2026 - 02:19 vuln.today

DescriptionCVE.org

picklescan before 0.0.28 fails to detect malicious pickle files that use torch.utils.data.datapipes.utils.decoder.basichandlers in reduce methods, allowing attackers to bypass safety checks. Remote attackers can embed undetected malicious code in pickle files that executes during deserialization, enabling remote code execution.

AnalysisAI

Safety-check bypass in picklescan before 0.0.28 allows attackers to smuggle malicious pickle files past the scanner by abusing torch.utils.data.datapipes.utils.decoder.basichandlers as a reduce gadget, so a payload the tool reports as clean still executes arbitrary code when the victim deserializes it. Because picklescan is a defensive scanner used to vet untrusted ML models (notably in Hugging Face workflows), this blind spot converts a trusted safety gate into a false sense of security. No public exploit identified at time of analysis, and it is not on CISA KEV; CVSS 4.0 base score is 7.6.

Technical ContextAI

picklescan statically inspects Python pickle streams to flag dangerous opcodes and imports that could trigger code execution during unpickling (CWE-502, Deserialization of Untrusted Data). Pickle's __reduce__ mechanism lets a serialized object specify a callable and arguments to run on load, which is the classic RCE primitive. The scanner maintains allow/deny lists of callables, and this flaw is a gap in that list: torch.utils.data.datapipes.utils.decoder.basichandlers - a PyTorch DataPipes decoder helper - was not recognized as an unsafe reduce target, so a crafted pickle routing execution through it evaded detection. The affected component is picklescan itself (cpe:2.3:a:picklescan:picklescan), the tool defenders rely on to gate untrusted PyTorch/ML model files.

RemediationAI

Upgrade picklescan to 0.0.28 or later, which adds detection for the torch.utils.data.datapipes.utils.decoder.basichandlers reduce gadget (Vendor-released patch: 0.0.28); see GHSA-h3qp-7fh3-f8h4 and the VulnCheck advisory for details. As a compensating control until upgraded, do not treat a picklescan 'clean' result as sufficient authorization to load a model: prefer loading models via safetensors instead of pickle to eliminate the deserialization primitive entirely, or restrict pickle loading to trusted publishers only. Where pickle loading is unavoidable, sandbox the deserialization process (isolated container, dropped privileges, no outbound network) so that any bypassed payload is contained - the trade-off is added pipeline complexity and latency. Avoid relying solely on scanner allowlists, since this CVE demonstrates that any single unlisted gadget defeats them.