Which versions of picklescan are affected by EUVD-2025-210411?

A vulnerability in picklescan, the primary security scanner for vetting ML model artifacts, creates a blind spot that allows attacker-controlled models to enter production undetected.. A patch is available.

How to fix or mitigate EUVD-2025-210411?

Within 24 hours: Identify all systems and teams using picklescan, and document recent model sources and deployments. Within 7 days: Implement additional security controls for pickle deserialization including code review of all pickle.load() operations, runtime monitoring for unexpected deserialization, and restrictions on model sources to trusted internal repositories. Within 30 days: Monitor vendor advisories for picklescan version 0.0.30 or later and plan an upgrade timeline; evaluate alternative serialization formats (SafeTensors, ONNX) as a longer-term solution to reduce reliance on pickle.

picklescan EUVD-2025-210411

Q: What is the CVSS score of EUVD-2025-210411?

EUVD-2025-210411 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2025-71343 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-04 VulnCheck

GHSA-8f67-79jr-8vpr

Deserialization Picklescan

7.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-delivered malicious file, no attacker privileges (PR:N), but victim must scan-then-load (UI:R); successful bypass yields arbitrary command execution, so C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 04, 2026 - 03:01 EUVD

Analysis Generated

Jul 04, 2026 - 02:01 vuln.today

DescriptionCVE.org

picklescan before 0.0.30 fails to detect malicious pickle files that exploit lib2to3.pgen2.pgen.ParserGenerator.make_label function in the reduce method. Attackers can craft malicious pickle files with embedded code that evades detection but executes arbitrary commands when pickle.load() is called.

AnalysisAI

Detection bypass in picklescan before 0.0.30 lets attackers smuggle malicious pickle files past the scanner by abusing lib2to3.pgen2.pgen.ParserGenerator.make_label as a reduce callable, so a file that picklescan clears still runs arbitrary commands when downstream code calls pickle.load(). picklescan is the security control itself - a static scanner used to vet ML model artifacts - so this weakness undermines the exact protection teams rely on to catch unsafe pickles. No public exploit identified at time of analysis and it is not on CISA KEV, but the technique is documented in VulnCheck and vendor advisories.

Technical ContextAI

picklescan is a Python tool that statically inspects pickle opcode streams to flag dangerous globals/reduce callables before a model is deserialized, and is embedded in ML supply-chain workflows (notably around Hugging Face model loading). The root cause is CWE-502 (Deserialization of Untrusted Data): Python's pickle format permits arbitrary object reconstruction via the __reduce__ protocol, and picklescan maintains an allow/deny model of which callables are dangerous. Here the payload routes execution through lib2to3.pgen2.pgen.ParserGenerator.make_label - a function in the standard library's legacy 2to3 grammar-parsing machinery that was not on picklescan's malicious-callable list - so the malicious REDUCE reference evades the scanner's heuristics while remaining a live code path at unpickle time. The single CPE, cpe:2.3:a:picklescan:picklescan:*:*:*:*:*:*:*:*, confirms the flaw is in picklescan itself, not in a consuming application.

RemediationAI

Vendor-released patch: upgrade picklescan to 0.0.30 or later, which adds detection for the lib2to3.pgen2.pgen.ParserGenerator.make_label bypass; pin the dependency to >=0.0.30 across CI, model-registry, and inference pipelines and rebuild any images that vendor an older copy. Consult the maintainer advisory at https://github.com/mmaitre314/picklescan/security/advisories/GHSA-p9w7-82w4-7q8m and the VulnCheck writeup at https://www.vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-lib2to3-pgen2-pgen-parsergenerator-make-label-detection-bypass for confirmation. Where immediate upgrade is not possible, do not treat a clean picklescan result as sufficient: prefer safetensors or other non-pickle formats for model weights (side effect: requires re-exporting models), load untrusted pickles only inside a network-isolated, least-privilege sandbox or container so a bypass yields no useful execution context (side effect: added deployment complexity), and restrict model ingestion to trusted/signed sources (side effect: slows onboarding of third-party models).