picklescan EUVD-2025-210387

Exploitation requires that the victim use picklescan (any version before 0.0.29) to scan an attacker-supplied pickle/model file AND subsequently deserialize that file with pickle.load() or equivalent - the payload must be a pickle reduce method that calls the built-in Python trace.Trace.runctx, which the scanner fails to flag. The limiting factors are the victim's reliance on picklescan as a trust gate and the requirement that the malicious file actually be loaded (passive user interaction, UI:P/AT:P); no authentication is needed by the attacker (PR:N) since they only need to deliver the crafted file. If picklescan is not part of the workflow, or if files are never deserialized after scanning, the condition is not met.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N) reflects a network-delivered, unauthenticated code-execution payload that nonetheless depends on two real-world gates: a passive Attack Requirement (AT:P) and Passive user interaction (UI:P) - namely that a victim actually scans the file with picklescan and then loads it. Impact is high for confidentiality and integrity but no availability impact is claimed. There is no EPSS score, no KEV listing, and no POC referenced in the provided data, so the practical signal is 'detection-bypass weakness with high theoretical impact but no evidence of active or widespread exploitation.' The notable nuance is that this CVE is not itself a primary RCE - it is a control-evasion bug; its severity is conditional on organizations trusting picklescan as a gate in their ML supply chain. For environments that do rely on picklescan, this should be patched promptly; for those that do not use picklescan, the CVE is not applicable.

An attacker publishes a malicious ML model to a public hub whose reduce method invokes trace.Trace.runctx; an organization's intake pipeline scans it with a pre-0.0.29 picklescan, which reports it clean, and a data scientist then loads the model with pickle.load(), executing the attacker's code in the ML environment. No public exploit is identified at time of analysis, but the technique is straightforward given the low attack complexity (AC:L) once a victim is induced to scan-then-load the file (UI:P/AT:P).