picklescan EUVD-2025-210307

Exploitation requires that (1) the victim uses picklescan ≤ 0.0.27 as a pre-load safety gate, (2) the victim subsequently calls pickle.load() or torch.load() on the scanned file, and (3) the host Python environment has torch installed so that torch.jit.unsupported_tensor_ops.execWrapper resolves at unpickle time. Limiting factors: user interaction is required (UI:P - the victim must actively load the file), and the bypass only matters where picklescan is treated as the trust boundary; environments that never deserialize untrusted pickle files, or that load models only through safetensors, are not exposed. No special network position or authentication is required to deliver the malicious file.

The CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N (7.6) reflects that exploitation is network-deliverable and unauthenticated, but requires both an attack-template condition (AT:P - the victim must run picklescan as a gating step and then load the file) and user interaction (UI:P - the victim chooses to pickle.load the scanned file). No EPSS score, no CISA KEV listing, and no reports of in-the-wild abuse were supplied, so this is not a mass-exploitation candidate today; however, publicly available exploit code exists in the GHSA advisory and the bypass is trivial to reproduce. Real-world risk is concentrated in ML model-hosting platforms, model hubs, and CI pipelines that treat picklescan as a trust boundary - for those users this is a priority fix because the tool's failure mode is silent (clean scan, then RCE). Note one nuance: VA:N (no availability impact) is conservative - execWrapper allows arbitrary code execution, which in practice can also destroy availability, but the base-metric mapping here follows the GHSA scoring.

An attacker uploads a malicious PyTorch model to a public hub or sends it to a victim ML engineer; the file embeds a __reduce__ returning torch.jit.unsupported_tensor_ops.execWrapper with an attacker-supplied code string. The victim runs picklescan, which reports the file as clean because execWrapper was not on its dangerous-function list, then calls pickle.load() (directly or via torch.load), at which point the payload executes with the privileges of the loading process. A working PoC is published in the GHSA advisory.