Which versions of picklescan are affected by CVE-2025-71376?

Picklescan, a Python security tool widely used to validate untrusted PyTorch models and serialized objects, fails to detect a method of code injection that allows attackers to embed executable…. A patch is available.

How to fix or mitigate CVE-2025-71376?

24 hours: Audit all picklescan deployments and immediately disable its use as a validation gate for untrusted pickle inputs. 7 days: Conduct forensic review of all PyTorch models and pickle files processed by picklescan; determine exposure to external sources and implement interim mitigations. 30 days: Deploy alternative model validation and sandboxing strategies; establish cryptographic signing requirements for internal model distribution.

picklescan CVE-2025-71376

Q: What is the CVSS score of CVE-2025-71376?

CVE-2025-71376 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2025-210308 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-23 VulnCheck

GHSA-gq8p-2329-gh3x

Deserialization Picklescan

7.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-delivered pickle with low complexity, no attacker auth, but requires victim to load the file (UI:R); full RCE yields C/I/A:H.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jun 23, 2026 - 14:17 EUVD

Source Code Evidence Fetched

Jun 23, 2026 - 13:03 vuln.today

Analysis Generated

Jun 23, 2026 - 13:03 vuln.today

DescriptionCVE.org

picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.autocomplete.AutoComplete.fetch_completions in reduce methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when loaded by victims.

AnalysisAI

Detection bypass in picklescan versions prior to 0.0.29 allows attackers to smuggle arbitrary code execution payloads through malicious pickle files by leveraging idlelib.autocomplete.AutoComplete.fetch_completions inside the __reduce__ method. Because the scanner does not flag this built-in Python function as dangerous, victims who rely on picklescan to vet PyTorch models or other pickle artifacts will load attacker-controlled code under pickle.load(). Publicly available exploit code exists (in the GHSA advisory), though no active in-the-wild exploitation has been reported.

Technical ContextAI

picklescan is a Python security utility (pip/picklescan) used to statically scan pickle files for dangerous opcodes and callables before deserialization, frequently applied to PyTorch model weights distributed via Hugging Face and similar registries. The root cause is a CWE-502 deserialization weakness manifesting as an incomplete denylist: the scanner's catalog of dangerous callables omits idlelib.autocomplete.AutoComplete.fetch_completions, a function in Python's standard library IDLE module that internally evaluates supplied expressions during tab-completion logic. By returning this callable from __reduce__, an attacker turns pickle deserialization into expression evaluation (e.g., __import__('os').system(...)) without tripping any of picklescan's detectors. The CPE cpe:2.3:a:picklescan:picklescan:*:*:* covers all versions before the 0.0.29 fix.

RemediationAI

Upgrade picklescan to 0.0.29 or later (pip install --upgrade 'picklescan>=0.0.29'), which incorporates the upstream fix in commit aecd11be98702caa9ba9b12189d91ad596a36114 referenced from the GHSA at https://github.com/mmaitre314/picklescan/security/advisories/GHSA-7cq8-mj8x-j263. If immediate upgrade is not feasible, treat picklescan output as advisory only and do not load untrusted pickle files based solely on a clean scan; preferred compensating controls include switching model distribution to safetensors where possible (eliminates pickle-based RCE entirely but requires re-saving models), executing pickle.load only inside a sandboxed/ephemeral process with no network or filesystem write access (adds operational overhead and may break model loaders that expect local cache), and explicitly blocking idlelib.* imports via a custom Unpickler.find_class allowlist (most reliable short-term mitigation but must be paired with a broader allowlist policy to be effective).