EUVD-2025-210308
GHSA-gq8p-2329-gh3x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft pickle with idlelib.autocomplete reduce payload
-
DeliveryDistribute via model hub or supply chain
-
ExploitVictim scans with vulnerable picklescan, no detection
-
ExecutionVictim calls pickle.load/torch.load
-
Persistfetch_completions evaluates attacker expression
-
ImpactArbitrary command execution in victim process
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the victim relies on picklescan (any version <0.0.29) to vet an attacker-supplied pickle/PyTorch file and then deserializes that file with pickle.load or torch.load; the attacker does not need credentials on the victim's system. The CVSS 4.0 metrics AT:P and UI:P correctly capture the two limiting factors: a specific deployment condition (use of vulnerable picklescan as the trust gate) and user interaction (the victim must load the file). It does not work against environments that load pickles without picklescan and reject all untrusted pickles anyway, nor against environments that have upgraded to 0.0.29 or use safetensors-only loaders. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N) scores 7.6 and is internally consistent: exploitation is network-deliverable through a malicious pickle file but requires both an attack requirement (the victim must use picklescan as their gatekeeper) and user interaction (loading the file). The vulnerability is not on the CISA KEV list and no EPSS score was supplied, so widespread opportunistic exploitation is not documented; however, a working PoC is published in the GHSA advisory, lowering the barrier substantially. The real-world risk concentrates on ML supply-chain pipelines that whitelist a model after picklescan reports it clean - in those workflows the impact is full RCE in the loading process. No conflict between sources was observed; the main missing signal is EPSS and any KEV/active-exploitation telemetry. |
| Exploit ScenarioDerived | An attacker uploads a poisoned PyTorch checkpoint or pickle artifact to a public model hub or supplies it via a phishing/supply-chain channel; the victim runs picklescan against the file, sees no findings, and then calls pickle.load() (often implicitly via torch.load), at which point the __reduce__ payload invokes idlelib.autocomplete.AutoComplete.fetch_completions with an os.system command and gains code execution in the data scientist's environment or model-serving job. The PoC in the GHSA advisory (EvilIdlelibAutocompleteFetchCompletions) demonstrates the full primitive in a few lines and would be trivial to weaponize. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 23, 2026
Detection bypass in picklescan versions prior to 0.0.29 allows attackers to smuggle arbitrary code execution payloads through malicious pickle files by leveraging idlelib.autocomplete.AutoComplete.fetch_completions inside the __reduce__ method. Because the scanner does not flag this built-in Python function as dangerous, victims who rely on picklescan to vet PyTorch models or other pickle artifacts will load attacker-controlled code under pickle.load(). Publicly available exploit code exists (in the GHSA advisory), though no active in-the-wild exploitation has been reported.
RemediationAI
Upgrade picklescan to 0.0.29 or later (pip install --upgrade 'picklescan>=0.0.29'), which incorporates the upstream fix in commit aecd11be98702caa9ba9b12189d91ad596a36114 referenced from the GHSA at https://github.com/mmaitre314/picklescan/security/advisories/GHSA-7cq8-mj8x-j263. If immediate upgrade is not feasible, treat picklescan output as advisory only and do not load untrusted pickle files based solely on a clean scan; preferred compensating controls include switching model distribution to safetensors where possible (eliminates pickle-based RCE entirely but requires re-saving models), executing pickle.load only inside a sandboxed/ephemeral process with no network or filesystem write access (adds operational overhead and may break model loaders that expect local cache), and explicitly blocking idlelib.* imports via a custom Unpickler.find_class allowlist (most reliable short-term mitigation but must be paired with a broader allowlist policy to be effective).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
picklescan is a Python security utility (pip/picklescan) used to statically scan pickle files for dangerous opcodes and callables before deserialization, frequently applied to PyTorch model weights distributed via Hugging Face and similar registries. The root cause is a CWE-502 deserialization weakness manifesting as an incomplete denylist: the scanner's catalog of dangerous callables omits idlelib.autocomplete.AutoComplete.fetch_completions, a function in Python's standard library IDLE module that internally evaluates supplied expressions during tab-completion logic. By returning this callable from __reduce__, an attacker turns pickle deserialization into expression evaluation (e.g., __import__('os').system(...)) without tripping any of picklescan's detectors. The CPE cpe:2.3:a:picklescan:picklescan:*:*:* covers all versions before the 0.0.29 fix.
Know when Picklescan gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Network-delivered pickle with low complexity, no attacker auth, but requires victim to load the file (UI:R); full RCE yields C/I/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.autocomplete.AutoComplete.fetch_completions in reduce methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when loaded by victims.
Executive ViewAI
Picklescan, a Python security tool widely used to validate untrusted PyTorch models and serialized objects, fails to detect a method of code injection that allows attackers to embed executable payloads in files marked as safe. Organizations that rely on this tool to secure their machine learning pipelines face direct risk of arbitrary code execution on systems that process validated models, especially as publicly available exploit code exists. This represents a critical control failure in securing external model artifacts.
No vendor-released patch identified at time of analysis. Disable picklescan validation immediately for untrusted inputs; enforce sandboxed or air-gapped execution for external model loading; implement manual code review and threat assessment for PyTorch models from external sources; require cryptographic signatures for all internal model artifacts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
More in Picklescan
View allRemote code execution against users of picklescan versions prior to 1.0.4 is achievable by smuggling any blocked functio
An Improper Handling of Exceptional Conditions vulnerability in the ZIP archive scanning component of mmaitre314 pickles
A Protection Mechanism Failure vulnerability in mmaitre314 picklescan versions up to and including 0.0.30 allows a remot
An Improper Input Validation vulnerability in the scanning logic of mmaitre314 picklescan versions up to and including 0
Detection bypass in picklescan prior to 0.0.29 allows attackers to smuggle remote code execution payloads through pickle
Detection bypass in picklescan versions before 0.0.25 allows attackers to embed remote code execution payloads in pickle
Detection bypass in picklescan before 0.0.28 allows attackers to embed malicious torch.jit.unsupported_tensor_ops.execWr
Detection bypass in picklescan before 0.0.28 allows attackers to smuggle arbitrary code through pickle files by abusing
Detection bypass in picklescan before 0.0.29 allows malicious pickle files to evade scanning by abusing the undetected i
Detection bypass in picklescan versions before 0.0.30 allows malicious pickle files to evade security scanning by using
Detection bypass in picklescan before 0.0.33 allows attackers to smuggle arbitrary code through malicious pickle files b
Detection bypass in picklescan before 0.0.29 allows attackers to craft malicious pickle files using idlelib.debugobj.Obj
Exploit-DB