EUVD-2025-210302
GHSA-xp4f-hrf8-rxw7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered malicious file (AV:N), no auth (PR:N), but victim must scan-then-load (UI:R); _run_pip yields full code execution so C/I/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
picklescan before 0.0.30 (affected versions 0.0.26 and earlier) fails to detect the ensurepip._run_pip built-in function when scanning pickle files, allowing attackers to execute arbitrary code. Malicious pickle files embedding ensurepip._run_pip calls in __reduce__ methods bypass picklescan detection and achieve remote code execution upon pickle.load() invocation.
AnalysisAI
Detection bypass in picklescan versions 0.0.26 and earlier (fixed in 0.0.30) allows attackers to smuggle arbitrary code through malicious pickle files by abusing Python's built-in ensurepip._run_pip function, which the scanner failed to flag as dangerous. Organizations relying on picklescan to vet PyTorch models or other serialized Python objects will load the file as safe and trigger remote code execution upon pickle.load(). Publicly available exploit code exists via the GHSA advisory PoC, though no public exploit identified in active campaigns at time of analysis.
Technical ContextAI
picklescan is a Python library that statically analyzes pickle files for dangerous opcodes and function references before deserialization, used heavily in the ML ecosystem (notably for PyTorch model vetting) where pickle deserialization is unavoidable. The vulnerability is a classic CWE-502 (Deserialization of Untrusted Data) detection-bypass: picklescan's denylist of dangerous callables did not include ensurepip._run_pip, a built-in stdlib helper that invokes pip with arbitrary arguments. An attacker places _run_pip in a class's __reduce__ method so that pickle.loads/load executes it, and because the scanner does not recognize the symbol, the file passes pre-load safety checks. Affected CPE is cpe:2.3:a:picklescan:picklescan up to and including 0.0.26 (advisory states <0.0.30).
RemediationAI
Vendor-released patch: upgrade picklescan to 0.0.30 or later (pip install --upgrade picklescan>=0.0.30), which adds ensurepip._run_pip to the dangerous-callable detection set per commit 1931c2d04eaca8d20597705ff39cab78ba364e4b. Until upgraded, treat picklescan results from older versions as non-authoritative and either refuse to load pickle files from untrusted sources entirely, switch to safer model formats such as safetensors for PyTorch weights (eliminates pickle execution risk but requires re-exporting models), or run pickle.load only inside a sandboxed/ephemeral container with no network egress and minimal filesystem privileges to contain _run_pip's ability to fetch and install arbitrary packages. Consult the GHSA advisory at https://github.com/mmaitre314/picklescan/security/advisories/GHSA-xp4f-hrf8-rxw7 for the authoritative fix details.
More in Picklescan
View allAn Improper Handling of Exceptional Conditions vulnerability in the ZIP archive scanning component of mmaitre314 pickles
A Protection Mechanism Failure vulnerability in mmaitre314 picklescan versions up to and including 0.0.30 allows a remot
An Improper Input Validation vulnerability in the scanning logic of mmaitre314 picklescan versions up to and including 0
Detection bypass in picklescan prior to 0.0.29 allows attackers to smuggle remote code execution payloads through pickle
Detection bypass in picklescan versions before 0.0.25 allows attackers to embed remote code execution payloads in pickle
Detection bypass in picklescan before 0.0.28 allows attackers to embed malicious torch.jit.unsupported_tensor_ops.execWr
Detection bypass in picklescan before 0.0.28 allows attackers to smuggle arbitrary code through pickle files by abusing
Detection bypass in picklescan before 0.0.29 allows malicious pickle files to evade scanning by abusing the undetected i
Detection bypass in picklescan versions before 0.0.30 allows malicious pickle files to evade security scanning by using
Detection bypass in picklescan versions prior to 0.0.29 allows attackers to smuggle arbitrary code execution payloads th
Detection bypass in picklescan before 0.0.33 allows attackers to smuggle arbitrary code through malicious pickle files b
Detection bypass in picklescan before 0.0.29 allows attackers to craft malicious pickle files using idlelib.debugobj.Obj
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today