Which versions of picklescan are affected by EUVD-2025-210416?

picklescan, a critical validation tool for machine-learning model security, contains a detection bypass vulnerability that allows attackers to inject executable code into pickle files without…. A patch is available.

How to fix or mitigate EUVD-2025-210416?

Within 24 hours: Identify all systems and workflows using picklescan for model or pickle file validation; document current versions deployed. Within 7 days: Implement layered defenses including air-gapped model loading environments, mandatory source verification, and additional deserialization validation; notify ML and data teams to halt new model imports pending security confirmation. Within 30 days: Monitor for picklescan version 0.0.29 or later releases as patches become available; establish cryptographic signing for all model artifacts; implement code review on all pickle file sources.

picklescan EUVD-2025-210416

Q: What is the CVSS score of EUVD-2025-210416?

EUVD-2025-210416 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2025-71359 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-04 VulnCheck

GHSA-vp8m-mf3r-82q9

Deserialization RCE Picklescan

7.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

AC:H because it requires both a crafted evasion gadget and victim reliance on picklescan; UI:R since the victim must load the pickle; PR:N as no auth is needed; full C/I/A from arbitrary code execution.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 04, 2026 - 03:01 EUVD

Analysis Generated

Jul 04, 2026 - 02:09 vuln.today

DescriptionCVE.org

picklescan before 0.0.29 fails to detect malicious pickle payloads that utilize lib2to3.pgen2.grammar.Grammar.loads in the reduce method, allowing remote code execution. Attackers can craft pickle files embedding dangerous code that evades picklescan detection and executes during pickle.load() deserialization.

AnalysisAI

Detection bypass in picklescan before 0.0.29 lets attackers slip malicious pickle payloads past the scanner by abusing lib2to3.pgen2.grammar.Grammar.loads inside a pickle reduce method, resulting in remote code execution when the file is later deserialized with pickle.load(). Because picklescan is trusted as a safety gate for machine-learning model files, a bypass converts a 'scanned and clean' verdict into silent arbitrary code execution. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, though the technique is concretely described in the VulnCheck advisory.

Technical ContextAI

picklescan is a Python security tool that statically inspects pickle (and pickle-bearing) files for dangerous opcodes/imports before they are loaded, and is widely used to vet untrusted machine-learning model artifacts. The root cause is CWE-502 (Deserialization of Untrusted Data): Python's pickle format permits arbitrary callables via the __reduce__ mechanism, and picklescan maintains an allow/deny model of which global references are considered dangerous. The bypass leverages lib2to3.pgen2.grammar.Grammar.loads - a method in Python's standard library 2to3 grammar module that itself unpickles data - which was not on picklescan's blocklist, so a reduce callable pointing at Grammar.loads passes the scan yet triggers a nested unpickle chain executing attacker code during pickle.load(). The affected CPE is cpe:2.3:a:picklescan:picklescan (all versions prior to 0.0.29).

RemediationAI

Upgrade to picklescan 0.0.29 or later, which adds detection for the lib2to3.pgen2.grammar.Grammar.loads gadget (Vendor-released patch: 0.0.29); consult GHSA-f54q-57x4-jg88 (https://github.com/mmaitre314/picklescan/security/advisories/GHSA-f54q-57x4-jg88) and the VulnCheck advisory for details. Because picklescan is a detection layer and not a runtime sandbox, do not treat a clean scan from any version as a guarantee - prefer loading untrusted model artifacts using safetensors or another non-executable serialization format, which eliminates pickle code execution entirely at the cost of migrating file formats. Where pickle must be used, restrict deserialization to trusted, signed, or checksum-verified sources and load in an isolated/sandboxed process with no network and least privilege so that even a scanner bypass cannot reach sensitive systems. Pin and monitor the picklescan dependency version across CI/CD so the fixed release is actually deployed everywhere the scan is relied upon.