Picklescan < 0.0.28 - CraftedSignal Threat Feed

CVE-2025-71369: Picklescan Malicious Pickle Detection Bypass Leading to RCE

hello@craftedsignal.io — Sat, 04 Jul 2026 02:27:56 +0000

CVE-2025-71369 addresses a critical flaw in picklescan versions released before 0.0.28, a tool designed to detect malicious Python pickle files. This vulnerability permits remote attackers to craft specially designed pickle files that leverage torch.utils.data.datapipes.utils.decoder.basichandlers within their __reduce__ methods. The picklescan library, when tasked with scanning such files, fails to identify the embedded malicious code, effectively bypassing its intended security checks. Consequently, when an affected application or system subsequently deserializes these "undetected" malicious pickle files, the embedded code is executed, leading to remote code execution (RCE). This poses a significant supply chain risk, as data scientists or ML engineers using vulnerable picklescan versions could inadvertently process compromised data, granting attackers control over their environments.

Attack Chain

An attacker crafts a malicious Python pickle file by embedding arbitrary code within the __reduce__ method, specifically utilizing torch.utils.data.datapipes.utils.decoder.basichandlers to evade detection.
The attacker distributes this malicious pickle file, potentially through compromised data repositories, malicious PyPI packages, or by sending it directly to a target.
A victim organization or individual downloads and stores the seemingly benign pickle file, potentially as part of a dataset or machine learning model.
The victim's environment, which integrates a vulnerable version of picklescan (prior to 0.0.28), processes or scans the downloaded pickle file.
Due to CVE-2025-71369, picklescan fails to identify the malicious payload within the pickle file, allowing it to be treated as legitimate.
A Python application or framework within the victim's environment attempts to deserialize the "clean" pickle file.
During the deserialization process, the malicious code embedded via the __reduce__ method is executed by the Python interpreter.
This execution leads to remote code execution (RCE), granting the attacker unauthorized control over the system where deserialization occurred, potentially allowing for data exfiltration, further compromise, or system disruption.

Impact

The successful exploitation of CVE-2025-71369 can lead to severe consequences, as remote code execution (RCE) grants attackers full control over the compromised system. This can result in unauthorized access to sensitive data, installation of backdoors, deployment of ransomware, or the use of the compromised system as a pivot point for further network penetration. Given the nature of pickle files in data science and machine learning workflows, this vulnerability presents a significant supply chain risk, potentially affecting numerous organizations that exchange or process such data. The CVSS v3.1 Base Score of 8.1 (High) underscores the critical nature of this flaw, highlighting the ease of exploitation and high impact on confidentiality and integrity.

Recommendation

Immediately upgrade picklescan to version 0.0.28 or later to remediate CVE-2025-71369, which contains the fix for this vulnerability.
Implement strict input validation and sanitization for all pickle files processed by your applications, especially those originating from untrusted or external sources.
Review existing practices for handling and deserializing pickle files; avoid deserializing untrusted data whenever possible.
Ensure that any systems processing pickle files operate with the principle of least privilege to minimize the potential impact of successful exploitation.

CVE-2025-71366: Picklescan Deserialization Vulnerability Leads to RCE

hello@craftedsignal.io — Sat, 04 Jul 2026 02:26:41 +0000

A significant deserialization vulnerability, tracked as CVE-2025-71366, has been identified in picklescan versions predating 0.0.28. This flaw allows malicious actors to craft Python pickle files that include specific torch.utils.bottleneck.__main__.run_cprofile function calls. Critically, the picklescan library, designed to detect and prevent malicious code execution from untrusted pickle files, fails to properly identify these embedded calls. This bypass of security checks enables remote attackers to inject and execute arbitrary code. When a victim's system loads such a specially crafted and undetected malicious pickle file, the embedded code executes with the privileges of the application processing the file, leading to potential system compromise and data loss. This vulnerability is highly impactful due to the widespread use of pickle files in Python ecosystems for data serialization and the security trust placed in picklescan.

Attack Chain

An attacker crafts a malicious Python pickle file containing a serialized object that leverages torch.utils.bottleneck.__main__.run_cprofile to embed arbitrary code.
The attacker ensures the payload is specifically designed to bypass the detection mechanisms implemented in picklescan versions older than 0.0.28.
The attacker delivers the crafted malicious pickle file to a target system, potentially through untrusted data ingestion, shared repositories, or direct download.
A user or an automated process on the victim's system initiates the loading of the malicious pickle file using a Python application that integrates with the vulnerable picklescan library.
During the scanning process, the vulnerable picklescan library (version < 0.0.28) fails to detect the malicious torch.utils.bottleneck.__main__.run_cprofile call due to the inherent deserialization vulnerability.
Upon deserialization of the undetected malicious pickle file, the embedded arbitrary code is executed on the victim's system, achieving remote code execution.

Impact

Successful exploitation of CVE-2025-71366 results in arbitrary code execution on the victim's system, allowing attackers to take full control of the compromised machine. This can lead to unauthorized data access, modification, or exfiltration; installation of malware such as ransomware or backdoors; and further lateral movement within the network. While specific victim counts or targeted sectors are not provided in the source, any organization or individual processing untrusted pickle files with vulnerable versions of picklescan could be at risk, especially those in data science, machine learning, or research environments.

Recommendation

Patch CVE-2025-71366 immediately by upgrading picklescan to version 0.0.28 or later to address the deserialization vulnerability.
Implement strict validation and sandboxing for all incoming pickle files, especially those from untrusted sources, even after patching, as a defense-in-depth measure against similar deserialization flaws.

CVE-2025-71356: picklescan Deserialization Vulnerability Leads to RCE

hello@craftedsignal.io — Sat, 04 Jul 2026 02:23:01 +0000

CVE-2025-71356 describes a critical deserialization vulnerability impacting picklescan versions before 0.0.28. This vulnerability arises because the library fails to properly detect malicious torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression function calls embedded within Python pickle files. Attackers can leverage this flaw to craft specially designed pickle files that, when loaded by a victim's application utilizing picklescan, execute arbitrary code. The issue allows for pre-payload code execution without detection, bypassing the intended security scanning capabilities of picklescan. This could allow threat actors to deliver malware, establish persistence, or exfiltrate data through seemingly benign data files, posing a significant risk to machine learning and data science environments that frequently exchange pickle files.

Attack Chain

An attacker crafts a malicious Python pickle file containing a specially constructed torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression call that includes arbitrary code.
The attacker delivers this malicious pickle file to a target system, potentially via email, compromised data repositories, or untrusted downloads.
A Python application on the victim's system attempts to load or process the pickle file.
If the picklescan library is used to scan the file for malicious content, it fails to detect the embedded arbitrary code within the torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression call.
During the standard Python pickle deserialization process, the vulnerable evaluate_guards_expression call is executed.
The embedded arbitrary code payload is then executed on the victim's system, leading to remote code execution, granting the attacker control over the compromised system.

Impact

Successful exploitation of CVE-2025-71356 can lead to complete system compromise through remote code execution. Victims, particularly those in data science, machine learning, and AI sectors that frequently handle pickle files from various sources, are at risk. Attackers could exploit this to deploy ransomware, establish backdoors, steal sensitive intellectual property, or use the compromised system as a pivot point for further network penetration. The undetected nature of the malicious code within the pickle file bypasses security controls, making this a high-impact vulnerability.

Recommendation

Upgrade picklescan to version 0.0.28 or later immediately to mitigate CVE-2025-71356.
Implement strict input validation and source verification for all Python pickle files loaded in your environment, especially those originating from untrusted sources, even after upgrading picklescan.
Review your software supply chain for components that use or process pickle files to identify and update any vulnerable instances of picklescan.

CVE-2025-71353: Picklescan Deserialization Vulnerability Leads to Remote Code Execution

hello@craftedsignal.io — Sat, 04 Jul 2026 02:22:16 +0000

CVE-2025-71353 details a critical deserialization vulnerability affecting picklescan versions prior to 0.0.28. picklescan is a tool designed to identify and mitigate malicious Python pickle files. However, this vulnerability allows attackers to craft specially designed pickle files that leverage the torch._dynamo.guards.GuardBuilder.get function within Python's reduce methods. These crafted files contain embedded arbitrary commands that picklescan fails to detect. Consequently, if such a file is subsequently loaded by an application, the malicious code can execute on the victim's system, leading to remote code execution (RCE). This vulnerability poses a significant risk to systems that process untrusted pickle files, as the security scanner intended to protect them can be bypassed.

Attack Chain

Attacker crafts malicious pickle file: An attacker generates a Python pickle file containing serialized data that, when deserialized, exploits the torch._dynamo.guards.GuardBuilder.get function in its reduce methods to embed arbitrary commands.
Distribution of malicious pickle file: The attacker distributes this malicious pickle file to a victim, potentially via email attachments, compromised package repositories, or direct downloads.
Victim scans file with picklescan: The victim system, or an application interacting with the file, uses picklescan (version prior to 0.0.28) to scan the received pickle file for malicious content.
picklescan fails detection: Due to the flaw described in CVE-2025-71353, picklescan fails to identify the embedded malicious payload within the specially crafted pickle file, deeming it safe.
Malicious pickle file is loaded: An application on the victim's system, trusting the scan results or lacking further validation, proceeds to load and deserialize the now "clean" malicious pickle file.
Arbitrary Command Execution: During the deserialization process, the embedded arbitrary commands are executed in the context of the vulnerable application, leading to remote code execution on the victim's system.

Impact

Successful exploitation of CVE-2025-71353 leads to remote code execution (RCE) on the compromised system. This grants attackers the ability to execute arbitrary commands, potentially leading to full system compromise, data theft, data alteration, or the deployment of further malware. The vulnerability has a CVSS v3.1 base score of 8.1 (High), reflecting high impacts on confidentiality and integrity, as attackers can bypass an intended security control to achieve their objectives. All applications and users relying on picklescan for validating Python pickle files are at risk if running affected versions.

Recommendation

Upgrade picklescan to version 0.0.28 or later immediately to remediate CVE-2025-71353.
Review and update any systems or applications that use picklescan to scan incoming pickle files to ensure they are using the patched version.
Implement strong input validation and integrity checks for all deserialized data, especially from untrusted sources, even after scanning.