picklescan EUVD-2025-210305

The victim must be running picklescan at a version earlier than 0.0.29 AND must rely on its verdict to decide whether to call pickle.load()/torch.load() on attacker-supplied content; if either condition is absent the bug is inert. The attacker also needs a delivery channel for the malicious pickle (model registry upload, shared dataset, supply-chain dependency) and the victim must take the user action of loading the scanned file (CVSS UI:P). No authentication to the victim system is required (PR:N), but execution runs only with the privileges of the Python process that performs the load.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N, 7.6) accurately captures the threat model: an attacker delivers a malicious pickle over the network, but execution depends on a victim choosing to load it (UI:P) after picklescan greenlights it (AT:P - present-attack-requirement that the target uses picklescan as their gate). No KEV listing and no EPSS data are provided, so this is not confirmed actively exploited; however, publicly available exploit code exists in the GHSA advisory and the payload is trivially adaptable. Real-world risk concentrates on ML/AI pipelines that ingest third-party model weights from Hugging Face or similar registries and trust picklescan as their primary defense - for those teams this is a high-priority gap, while environments that already treat pickle as untrusted regardless of scanner output are less exposed.

An attacker uploads a poisoned PyTorch model to a public registry whose __reduce__ method returns (profile.Profile.runctx, (Profile(), "__import__('os').system(...)", {}, {})). A downstream MLOps pipeline runs picklescan, sees no flagged callables, and proceeds to torch.load() the file, which triggers pickle deserialization and executes the embedded shell command in the inference worker's context. The PoC from the GHSA advisory demonstrates this end-to-end in a few lines of Python.