Which versions of picklescan are affected by CVE-2025-71371?

picklescan, widely deployed to validate Python pickle files in machine learning pipelines, contains a detection bypass vulnerability (CVSS 7.6) that allows attackers to disguise malicious code as…. A patch is available.

How to fix or mitigate CVE-2025-71371?

24 hours: Identify all systems and applications using picklescan versions before 0.0.29; enable monitoring and alerting on pickle deserialization operations. 7 days: Conduct forensic audit of pickle files processed by vulnerable picklescan versions for compromise indicators; evaluate transition to safer serialization formats (JSON, ONNX, Protocol Buffers). 30 days: Upgrade all picklescan deployments to version 0.0.29 or later upon release; implement defense-in-depth including cryptographic file signing/verification, sandbox environments for deserialization, and network segmentation.

picklescan CVE-2025-71371

Q: What is the CVSS score of CVE-2025-71371?

CVE-2025-71371 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2025-210391 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-30 VulnCheck

GHSA-h96j-r2w4-m289

Deserialization RCE Picklescan

7.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Remote payload but exploitation needs the victim to scan with a vulnerable picklescan and then load the file, so AC:H and UI:R; successful unpickling yields full RCE, hence C:H/I:H/A:H with PR:N.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 01, 2026 - 02:16 EUVD

Analysis Generated

Jun 30, 2026 - 23:28 vuln.today

DescriptionCVE.org

picklescan before 0.0.29 fails to detect malicious pickle files using code.InteractiveInterpreter.runcode in reduce methods. Attackers can craft pickle payloads that bypass picklescan detection and execute arbitrary code when loaded via pickle.load().

AnalysisAI

Malicious-pickle detection bypass in picklescan before 0.0.29 lets attackers smuggle weaponized pickle files past the scanner by abusing code.InteractiveInterpreter.runcode inside a __reduce__ method, leading to arbitrary code execution when the file is later deserialized with pickle.load(). picklescan is a security scanner specifically meant to flag dangerous pickles (e.g. in ML model files), so a gap in its blocklist directly defeats the control users rely on. Reported by VulnCheck with an assigned CVSS 4.0 score of 7.6; no public exploit and no CISA KEV listing identified at time of analysis.

Technical ContextAI

Python's pickle format is inherently unsafe: during unpickling, an object's __reduce__ method can return a callable and arguments that pickle will execute, which is the canonical CWE-502 (Deserialization of Untrusted Data) vector. picklescan defends against this by statically inspecting pickle opcodes/imports and blocklisting known dangerous callables before a file is trusted. The flaw is that its blocklist did not account for code.InteractiveInterpreter.runcode (from Python's standard code module), which can execute arbitrary Python passed to it. By routing payload execution through this unrecognized callable in a crafted __reduce__, an attacker produces a pickle that picklescan rates as clean but that runs code on load. The single affected component per CPE is cpe:2.3:a:picklescan:picklescan:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: 0.0.29 - upgrade picklescan to 0.0.29 or later (e.g. pip install --upgrade 'picklescan>=0.0.29') so the scanner recognizes the code.InteractiveInterpreter.runcode vector. Until upgraded, do not treat a clean picklescan result from an older version as authoritative; compensating controls include refusing to load pickles from untrusted sources, preferring safe serialization formats such as safetensors for ML model weights (trade-off: requires model re-export/conversion), and unpickling only inside a sandboxed/least-privilege process with no network or sensitive filesystem access (trade-off: added operational complexity). Review the GitHub advisory at https://github.com/mmaitre314/picklescan/security/advisories/GHSA-cj3c-v495-4xqh and the VulnCheck advisory at https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-code-interactiveinterpreter-detection-bypass for authoritative guidance.