Which versions of picklescan are affected by EUVD-2025-210389?

picklescan, a Python security scanner used to validate untrusted pickle files and ML models before execution, fails to detect a specific malicious payload pattern using cProfile.run, enabling…. A patch is available.

How to fix or mitigate EUVD-2025-210389?

24 HOURS: Identify all systems running picklescan versions below 0.0.30 and assess exposure to untrusted pickle sources (external datasets, user uploads, third-party models). 7 DAYS: Deploy compensating controls (see below) for systems processing untrusted pickle data. 30 DAYS: Monitor the picklescan project (upstream: trailofbits/picklescan) for patch release and plan forced upgrade to 0.0.30 or later; evaluate alternative pickle validation tools if patch does not materialize within 30 days.

picklescan EUVD-2025-210389

Q: What is the CVSS score of EUVD-2025-210389?

EUVD-2025-210389 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

| CVE-2025-71363 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-30 VulnCheck

GHSA-r9rj-xr26-286v

Deserialization RCE Picklescan

7.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Remote, no attacker auth (PR:N), but requires the victim to use picklescan and then load the file (AC:H/UI:R); successful unpickling yields full code execution, so C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 01, 2026 - 02:16 EUVD

Analysis Generated

Jun 30, 2026 - 23:29 vuln.today

DescriptionCVE.org

picklescan before 0.0.30 fails to detect cProfile.run function calls in pickle reduce methods, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files with cProfile.run payloads that bypass picklescan detection and achieve code execution upon deserialization.

AnalysisAI

Scanner-detection bypass in picklescan before 0.0.30 lets a crafted pickle file evade malicious-code detection and execute arbitrary code on deserialization. The tool - a Python security scanner used to vet untrusted pickle/ML model files - fails to flag cProfile.run calls embedded in a pickle object's __reduce__ method, so a payload routed through cProfile.run passes the scan and then runs when the file is loaded. Reported by VulnCheck (CWE-502); no public exploit identified at time of analysis and it is not in CISA KEV.

Technical ContextAI

picklescan is a defensive Python library that statically inspects pickle streams (and ML model archives) for known dangerous opcodes and callable references before a victim deserializes them, acting as a guardrail in ML supply chains such as model-hub downloads. The flaw is a CWE-502 (Deserialization of Untrusted Data) issue manifesting as an allow-list/detection gap: Python's pickle __reduce__ protocol can name an arbitrary callable to invoke at load time, and picklescan's blocklist of dangerous callables did not include cProfile.run, which itself executes a passed code string/statement. An attacker therefore wraps the real payload so the only top-level callable seen is cProfile.run, which the scanner treats as benign; on pickle.load, cProfile.run executes the attacker-supplied code. The CPE cpe:2.3:a:picklescan:picklescan:* confirms the affected component is the picklescan package itself, not the downstream application embedding it.

RemediationAI

Vendor-released patch: upgrade picklescan to version 0.0.30 or later, which adds detection for cProfile.run in reduce methods (advisory: https://github.com/mmaitre314/picklescan/security/advisories/GHSA-49gj-c84q-6qm9). Pin the fixed version in requirements/lockfiles and rebuild any container images or CI jobs that vendor an older copy. Until you can upgrade, do not treat a clean picklescan result as sufficient assurance: avoid pickle.load on untrusted model files entirely, prefer non-executable formats such as safetensors where possible, and load any unavoidable pickle content in a sandboxed/network-isolated, least-privilege environment so that code execution is contained - the trade-off is added operational friction and slower model onboarding. Where feasible, layer a second scanner (e.g., another deserialization analyzer) so a single tool's blind spot is not the only control.