Which versions of picklescan are affected by EUVD-2025-210386?

picklescan, a security scanner used by organizations to vet third-party machine learning models, has a bypass flaw allowing malicious code to evade detection and execute upon model deployment.. A patch is available.

How to fix or mitigate EUVD-2025-210386?

Within 24 hours: Identify all systems running picklescan and document current versions deployed. Within 7 days: Upgrade to picklescan 0.0.28 across all deployments and audit models scanned in the prior 30 days for signs of compromise. Within 30 days: Implement code review for all deserialized model artifacts and evaluate supplementary scanning tools as defense-in-depth measures.

picklescan EUVD-2025-210386

Q: What is the CVSS score of EUVD-2025-210386?

EUVD-2025-210386 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2025-71350 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-30 VulnCheck

GHSA-px3v-38wh-q34v

Deserialization Picklescan

7.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-delivered malicious file requires the victim to scan-and-load it (UI:R) with no auth (PR:N); successful unpickling yields arbitrary command execution, so full C/I/A.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 01, 2026 - 02:16 EUVD

Analysis Generated

Jun 30, 2026 - 23:30 vuln.today

DescriptionCVE.org

picklescan before 0.0.28 fails to detect malicious pickle files using torch.utils.collect_env.run function in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.

AnalysisAI

Malicious-pickle detection bypass in picklescan before 0.0.28 lets attackers smuggle remote-code-execution payloads past the scanner by hiding them in a pickle reduce method that invokes torch.utils.collect_env.run, which picklescan's blocklist failed to flag. Because picklescan is the gatekeeper many ML pipelines rely on to vet untrusted models (notably scanning Hugging Face artifacts), a 'clean' verdict on a weaponized file directly leads to command execution when the victim deserializes it. Reported by VulnCheck with a fix in 0.0.28; no public exploit identified at time of analysis and not listed in CISA KEV.

Technical ContextAI

picklescan is a Python tool that statically inspects Python pickle files for dangerous opcodes and global references before they are loaded, acting as a safety check for ML model distribution formats (e.g., PyTorch .bin/.pt files, which embed pickles). The root cause is CWE-502 (Deserialization of Untrusted Data): Python's pickle executes a __reduce__/REDUCE callable on load, and picklescan maintains an allow/deny list of callables it considers dangerous. The torch.utils.collect_env.run helper - a thin wrapper that shells out to run system commands for environment diagnostics - was not on picklescan's dangerous-callable list, so a reduce method pointing at it slipped through scanning while still providing arbitrary command execution at unpickle time. The CPE cpe:2.3:a:picklescan:picklescan:*:*:*:*:*:*:*:* confirms the affected component is the picklescan package itself, not PyTorch; PyTorch is merely the source of the abused gadget function.

RemediationAI

Vendor-released patch: upgrade picklescan to 0.0.28 or later, which adds torch.utils.collect_env.run to the detected dangerous-callable set; pin this minimum in requirements/CI so older versions cannot be reintroduced (see https://github.com/mmaitre314/picklescan/security/advisories/GHSA-f745-w6jp-hpxx). Because this is a scanner-evasion bug rather than a flaw in the model loader, do not treat a picklescan 'clean' result from a pre-0.0.28 version as trustworthy. Until upgraded, compensating controls: prefer loading models in safetensors format instead of pickle (eliminates arbitrary-callable execution entirely, but requires re-exporting models); load untrusted pickles only with weights_only=True on supported PyTorch versions (blocks arbitrary global execution, though it rejects checkpoints that legitimately need non-tensor objects); and sandbox deserialization in a network-isolated, least-privilege container so a successful bypass cannot reach internal systems (adds operational overhead). Avoid relying on a second signature-based scanner alone, since the same allowlist-gap class can recur.