Which versions of picklescan are affected by CVE-2025-71374?

picklescan is a defensive security tool that organizations deploy to automatically certify machine learning models and pickle files as safe before production deployment.. A patch is available.

How to fix or mitigate CVE-2025-71374?

Within 24 hours: Identify all systems and workflows using picklescan and document the versions currently deployed. Within 7 days: Implement compensating controls (manual security review of pickle/model files before production deployment, disable automatic acceptance of scanned files if feasible, or evaluate alternative scanning tools). Within 30 days: Monitor picklescan repository and security advisories for patch release; develop remediation plan for any models deployed after the vulnerability discovery date.

picklescan CVE-2025-71374

Q: What is the CVSS score of CVE-2025-71374?

CVE-2025-71374 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2025-210392 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-30 VulnCheck

GHSA-f79r-3fcg-p98x

Deserialization Python RCE Picklescan

7.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Remotely delivered file with no privileges (AV:N/PR:N) but the victim must scan-trust-then-load it (UI:R), and successful unpickling yields full arbitrary code execution (C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 01, 2026 - 02:16 EUVD

Analysis Generated

Jun 30, 2026 - 23:27 vuln.today

DescriptionCVE.org

picklescan before 0.0.29 fails to detect the built-in python profile.Profile.run function when used in pickle reduce methods, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files that bypass picklescan detection and achieve code execution upon deserialization.

Articles & Coverage 1

News 5 New Python Vulnerabilities - 2 Critical, 3 High Severity Jul 01, 2026

AnalysisAI

Arbitrary code execution bypass in picklescan before 0.0.29 lets attackers smuggle malicious Python pickle files past the scanner by abusing the built-in profile.Profile.run function inside a pickle __reduce__ method, which picklescan's blocklist fails to flag. Because picklescan is a defensive ML supply-chain tool meant to certify pickle/model files as safe, the flaw is a security-control evasion: a file marked 'clean' executes attacker code on deserialization. No public exploit is identified at time of analysis, and it is not in CISA KEV; the CVSS 4.0 base score is 7.6 (High).

Technical ContextAI

picklescan is a Python utility (cpe:2.3:a:picklescan:picklescan) widely used to statically inspect pickle and serialized ML model files for dangerous opcodes/imports before they are loaded with pickle.load(). The Python pickle protocol allows objects to define a __reduce__ method that returns a callable plus arguments to be invoked at unpickling time; this is the canonical pickle RCE primitive (CWE-502, Deserialization of Untrusted Data). picklescan works by matching the callables referenced in a pickle stream against a denylist of known-dangerous globals (os.system, subprocess, exec, etc.). The root cause here is an incomplete denylist: the standard-library cProfile/profile module's profile.Profile.run method accepts and executes a string of Python code, giving an arbitrary-code-execution gadget that picklescan did not enumerate. Thus a __reduce__ returning (profile.Profile().run, ('<malicious code>',)) survives the scan but runs the supplied code when the file is deserialized.

RemediationAI

Vendor-released patch: upgrade picklescan to 0.0.29 or later, which extends detection to cover profile.Profile.run (see GHSA-x696-vm39-cp64). Until upgraded, do not treat a picklescan 'clean' result as sufficient authorization to load a pickle/model file from an untrusted source. As compensating controls: load untrusted models only in sandboxed/isolated environments (containers without network egress, least-privilege service accounts) so that any unpickling RCE is contained - trade-off is added pipeline complexity; prefer safer serialization formats such as safetensors for model weights where feasible, eliminating the pickle RCE primitive entirely - trade-off is conversion effort and limited support for arbitrary Python objects; and add a custom denylist/allowlist entry for profile.Profile.run and other cProfile/profile callables if you maintain wrapper scanning logic. Pull the exact patched version from the official PyPI/GitHub release referenced in the advisory.