Which versions of Picklescan are affected by EUVD-2025-210388?

Picklescan, a Python malware scanning tool, contains a bypass vulnerability that allows attackers to disguise malicious pickle files as safe.. A patch is available.

How to fix or mitigate EUVD-2025-210388?

24 hours: Inventory all systems running Picklescan and review scanning logs for suspicious patterns. 7 days: Restrict use of Picklescan for final security clearance on untrusted pickle files; implement manual code review for high-risk deserializations. 30 days: Monitor Picklescan releases for version 0.0.25 or later and upgrade when available, or migrate to alternative pickle validation tools.

Picklescan EUVD-2025-210388

Q: What is the CVSS score of EUVD-2025-210388?

EUVD-2025-210388 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

| CVE-2025-71355 HIGH

Incomplete List of Disallowed Inputs (CWE-184)

2026-06-30 VulnCheck

GHSA-7jm4-f7vj-6pcc

Deserialization RCE Picklescan

7.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-delivered but requires the victim to load the pickle under a Picklescan-gated flow (UI:R, AC:H for that attack requirement); successful loading yields full code execution, so C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 01, 2026 - 02:16 EUVD

Analysis Generated

Jun 30, 2026 - 23:29 vuln.today

DescriptionCVE.org

Picklescan before 0.0.25 fails to detect unsafe global functions in the Numpy library, allowing attackers to bypass static analysis and execute arbitrary code during deserialization. Attackers can craft malicious pickle files using numpy.testing._private.utils.runstring within the reduce method to import dangerous libraries like os and execute arbitrary OS commands when the pickle file is loaded.

AnalysisAI

Static-analysis bypass in Picklescan before 0.0.25 lets attackers smuggle malicious pickle files past its malware scanner, leading to arbitrary OS command execution when a victim deserializes the file. Picklescan's denylist fails to flag unsafe Numpy globals, so a reduce method invoking numpy.testing._private.utils.runstring can import os and run commands while being reported as safe. No public exploit has been identified at time of analysis, though VulnCheck's advisory documents the exact gadget; the issue is not in CISA KEV. CVSS 4.0 base score is 7.6.

Technical ContextAI

Picklescan is a Python security tool that statically inspects pickle (.pkl) files - a common serialization format for ML model weights - to detect dangerous globals before deserialization, and it is integrated into ML supply-chain flows such as Hugging Face model scanning. The vulnerability is a CWE-184 (Incomplete List of Disallowed Inputs) failure: Picklescan maintains a denylist of unsafe callables but omits certain Numpy functions, notably numpy.testing._private.utils.runstring. Because Python's pickle protocol executes the callable named in an object's __reduce__ method during loading, an attacker who references a missed Numpy global can execute arbitrary Python (and via os, arbitrary OS commands) while Picklescan returns a clean verdict. The single affected component is cpe:2.3:a:picklescan:picklescan, with all versions before 0.0.25 affected.

RemediationAI

Vendor-released patch: 0.0.25 - upgrade Picklescan to 0.0.25 or later (e.g. pip install --upgrade 'picklescan>=0.0.25') so the missed Numpy globals are added to the denylist, per GHSA-fj43-3qmq-673f. Because this is a scanner-bypass, do not treat Picklescan as a sole trust boundary: where feasible, load untrusted pickles only under restricted execution (sandboxed/containerized worker with no outbound network and least-privilege OS user) so that a residual bypass cannot run useful commands, and prefer safer serialization formats such as safetensors for model weights, which removes pickle code-execution risk entirely (trade-off: requires producers to publish in that format). Restricting model ingestion to vetted, signed sources reduces the chance of a malicious pickle reaching the loader in the first place, at the cost of pipeline flexibility.