EUVD-2025-210293
GHSA-8mc5-7w9m-fqv6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Malicious pickle is delivered over the network (AV:N), exploitation is reliable once crafted (AC:L), no auth to the victim (PR:N), but the victim must choose to load the file (UI:R); code execution yields high C/I, A:N since the payload is not inherently DoS.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.
AnalysisAI
Detection bypass in picklescan before 0.0.30 allows attackers to smuggle arbitrary code execution payloads through pickle files by abusing idlelib.pyshell.ModifiedInterpreter.runcommand inside a __reduce__ method, which the scanner fails to flag as dangerous. Any victim who relies on picklescan to vet PyTorch models or other pickle artifacts and then calls pickle.load() will execute attacker-supplied commands. Publicly available exploit code exists (PoC published in the GHSA advisory), no CISA KEV listing, and the issue is fixed in version 0.0.30.
Technical ContextAI
picklescan is a Python static scanner designed to enumerate the callables referenced by pickle opcodes and flag known-dangerous ones (os.system, subprocess.*, eval, exec, etc.) before a user calls pickle.load(). It maintains an allow/deny list of module.function names. CWE-502 (Deserialization of Untrusted Data) is the underlying class: pickle's __reduce__ protocol lets any object specify an arbitrary callable plus arguments to be invoked at load time. The bypass leverages idlelib.pyshell.ModifiedInterpreter.runcommand - a method shipped inside CPython's standard idlelib package - which ultimately executes a string of Python source. Because picklescan's denylist did not enumerate idlelib.pyshell.ModifiedInterpreter.runcommand, a __reduce__ returning (ModifiedInterpreter.runcommand, (fake_self, payload)) passed the scan while still executing __import__('os').system(...) on load. CPE coverage is limited to cpe:2.3:a:picklescan:picklescan:*:*:*:*:*:*:*:*.
RemediationAI
Vendor-released patch: upgrade picklescan to 0.0.30 or later (pip install -U picklescan>=0.0.30); the fix is commit 1931c2d04eaca8d20597705ff39cab78ba364e4b referenced from GHSA-j343-8v2j-ff7w (https://github.com/mmaitre314/picklescan/security/advisories/GHSA-j343-8v2j-ff7w). Until the upgrade is rolled out, treat picklescan output as advisory only and refuse to pickle.load() untrusted artifacts - prefer safer formats such as safetensors for model weights, which removes the deserialization sink entirely (trade-off: existing .pt/.bin/.pkl assets must be re-serialized). As an interim denylist supplement, block any pickle whose GLOBAL/STACK_GLOBAL opcodes reference the idlelib.* namespace, which has no legitimate use inside ML model files (trade-off: low false-positive risk, but does not address the next undiscovered gadget). For multi-tenant model registries, run loads inside a sandboxed, network-egress-restricted worker so an undetected gadget cannot reach attacker infrastructure (trade-off: added orchestration complexity).
More in Picklescan
View allAn Improper Handling of Exceptional Conditions vulnerability in the ZIP archive scanning component of mmaitre314 pickles
A Protection Mechanism Failure vulnerability in mmaitre314 picklescan versions up to and including 0.0.30 allows a remot
An Improper Input Validation vulnerability in the scanning logic of mmaitre314 picklescan versions up to and including 0
Detection bypass in picklescan prior to 0.0.29 allows attackers to smuggle remote code execution payloads through pickle
Detection bypass in picklescan versions before 0.0.25 allows attackers to embed remote code execution payloads in pickle
Detection bypass in picklescan before 0.0.28 allows attackers to embed malicious torch.jit.unsupported_tensor_ops.execWr
Detection bypass in picklescan before 0.0.28 allows attackers to smuggle arbitrary code through pickle files by abusing
Detection bypass in picklescan before 0.0.29 allows malicious pickle files to evade scanning by abusing the undetected i
Detection bypass in picklescan versions before 0.0.30 allows malicious pickle files to evade security scanning by using
Detection bypass in picklescan versions prior to 0.0.29 allows attackers to smuggle arbitrary code execution payloads th
Detection bypass in picklescan before 0.0.33 allows attackers to smuggle arbitrary code through malicious pickle files b
Detection bypass in picklescan before 0.0.29 allows attackers to craft malicious pickle files using idlelib.debugobj.Obj
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today