Attack Chain

1. An attacker crafts a malicious Python pickle file containing arbitrary code embedded within operator.methodcaller function calls.
2. The attacker delivers this malicious pickle file to a target system, potentially via email, file upload functionality, or as part of a data exchange.
3. The target system, which is configured to process Python pickle files, receives the malicious payload.
4. The system invokes picklescan (version prior to 0.0.33) to validate the safety and integrity of the incoming pickle file.
5. During validation, picklescan fails to correctly identify and flag the operator.methodcaller function calls as malicious, allowing the bypass of its security checks.
6. The target application, erroneously assuming the pickle file is safe based on picklescan's flawed validation, proceeds to load the file into memory.
7. Upon loading, the arbitrary code embedded within the operator.methodcaller context is executed on the target system.
8. The attacker achieves arbitrary code execution, leading to system compromise, which can involve data exfiltration, further persistence, or other malicious actions.

Impact

Successful exploitation of CVE-2025-71373 grants remote attackers arbitrary code execution capabilities on affected systems. Organizations utilizing picklescan for validating pickle files, particularly in data processing pipelines or applications handling untrusted serialized Python objects, are at risk. This could lead to complete compromise of the affected servers or workstations, potentially resulting in data breaches, installation of malware, or disruption of critical services. The CVSS score of 8.1 reflects the high severity, indicating that an unauthenticated attacker can achieve high confidentiality and integrity impact with low attack complexity.

Recommendation

• Immediately update picklescan to version 0.0.33 or later to patch CVE-2025-71373.
• Ensure all applications handling Python pickle files validate their source and integrity rigorously, even when using security scanners.
• Implement robust input validation and sanitization for all external inputs, especially those that might involve deserialization of data, to prevent malicious pickle files from being processed.

Attack Chain

1. An attacker crafts a malicious Python pickle file by embedding arbitrary code within the __reduce__ method, specifically utilizing torch.utils.data.datapipes.utils.decoder.basichandlers to evade detection.
2. The attacker distributes this malicious pickle file, potentially through compromised data repositories, malicious PyPI packages, or by sending it directly to a target.
3. A victim organization or individual downloads and stores the seemingly benign pickle file, potentially as part of a dataset or machine learning model.
4. The victim's environment, which integrates a vulnerable version of picklescan (prior to 0.0.28), processes or scans the downloaded pickle file.
5. Due to CVE-2025-71369, picklescan fails to identify the malicious payload within the pickle file, allowing it to be treated as legitimate.
6. A Python application or framework within the victim's environment attempts to deserialize the "clean" pickle file.
7. During the deserialization process, the malicious code embedded via the __reduce__ method is executed by the Python interpreter.
8. This execution leads to remote code execution (RCE), granting the attacker unauthorized control over the system where deserialization occurred, potentially allowing for data exfiltration, further compromise, or system disruption.

Impact

The successful exploitation of CVE-2025-71369 can lead to severe consequences, as remote code execution (RCE) grants attackers full control over the compromised system. This can result in unauthorized access to sensitive data, installation of backdoors, deployment of ransomware, or the use of the compromised system as a pivot point for further network penetration. Given the nature of pickle files in data science and machine learning workflows, this vulnerability presents a significant supply chain risk, potentially affecting numerous organizations that exchange or process such data. The CVSS v3.1 Base Score of 8.1 (High) underscores the critical nature of this flaw, highlighting the ease of exploitation and high impact on confidentiality and integrity.

Recommendation

• Immediately upgrade picklescan to version 0.0.28 or later to remediate CVE-2025-71369, which contains the fix for this vulnerability.
• Implement strict input validation and sanitization for all pickle files processed by your applications, especially those originating from untrusted or external sources.
• Review existing practices for handling and deserializing pickle files; avoid deserializing untrusted data whenever possible.
• Ensure that any systems processing pickle files operate with the principle of least privilege to minimize the potential impact of successful exploitation.

Attack Chain

1. Attacker crafts a malicious Python pickle file containing carefully constructed bytecode.
2. The malicious pickle payload specifically utilizes the _operator.attrgetter function within reduce methods to invoke arbitrary code.
3. This specific structure is designed to evade the security detection mechanisms implemented in picklescan versions before 0.0.34.
4. The attacker delivers this crafted pickle file to a victim system, potentially via email attachments, compromised package repositories, or malicious downloads.
5. A vulnerable application on the victim system attempts to deserialize the malicious pickle file using Python's pickle.load() function.
6. During the deserialization process, the integrated picklescan library (version < 0.0.34) fails to identify the embedded, malicious _operator.attrgetter calls as a threat.
7. Due to picklescan's detection bypass, the deserialization process proceeds unchecked, leading to the execution of the arbitrary code defined within the malicious pickle payload.
8. The attacker successfully achieves arbitrary code execution on the victim system, potentially leading to system compromise, data theft, or further lateral movement.

Impact

Successful exploitation of CVE-2025-71367 can lead to severe consequences for organizations utilizing picklescan versions before 0.0.34. Since the vulnerability allows for arbitrary code execution, attackers can gain full control over the compromised system, leading to unauthorized data access, modification, or destruction. This could result in significant data breaches, operational disruption, and reputational damage. While specific victim counts are not available, any system processing untrusted pickle files with vulnerable picklescan versions is at risk, particularly those in data science, machine learning, or software development pipelines where pickle is frequently used for object serialization.

Recommendation

• Immediately update picklescan to version 0.0.34 or higher to remediate CVE-2025-71367.
• Ensure all applications and services that handle pickle files are using the patched picklescan library.
• Implement secure deserialization practices, avoiding pickle.load() of untrusted data even with security scanning, as illustrated by CVE-2025-71367.

Attack Chain

1. An attacker crafts a malicious Python pickle file containing a serialized object that leverages torch.utils.bottleneck.__main__.run_cprofile to embed arbitrary code.
2. The attacker ensures the payload is specifically designed to bypass the detection mechanisms implemented in picklescan versions older than 0.0.28.
3. The attacker delivers the crafted malicious pickle file to a target system, potentially through untrusted data ingestion, shared repositories, or direct download.
4. A user or an automated process on the victim's system initiates the loading of the malicious pickle file using a Python application that integrates with the vulnerable picklescan library.
5. During the scanning process, the vulnerable picklescan library (version < 0.0.28) fails to detect the malicious torch.utils.bottleneck.__main__.run_cprofile call due to the inherent deserialization vulnerability.
6. Upon deserialization of the undetected malicious pickle file, the embedded arbitrary code is executed on the victim's system, achieving remote code execution.

Impact

Successful exploitation of CVE-2025-71366 results in arbitrary code execution on the victim's system, allowing attackers to take full control of the compromised machine. This can lead to unauthorized data access, modification, or exfiltration; installation of malware such as ransomware or backdoors; and further lateral movement within the network. While specific victim counts or targeted sectors are not provided in the source, any organization or individual processing untrusted pickle files with vulnerable versions of picklescan could be at risk, especially those in data science, machine learning, or research environments.

Recommendation

• Patch CVE-2025-71366 immediately by upgrading picklescan to version 0.0.28 or later to address the deserialization vulnerability.
• Implement strict validation and sandboxing for all incoming pickle files, especially those from untrusted sources, even after patching, as a defense-in-depth measure against similar deserialization flaws.

Attack Chain

1. Vulnerability Identification: An attacker identifies a target system or application that uses picklescan (version < 0.0.33) to process Python pickle files.
2. Malicious Pickle File Creation: The attacker crafts a specially designed pickle file that contains malicious Python code. This code is structured to exploit the unsafe deserialization flaw in numpy.f2py.crackfortran functions, ensuring that when the file is loaded, the eval function is called with the attacker's payload.
3. Delivery: The attacker delivers the malicious pickle file to the victim. This could be via email (as an attachment), through a compromised web application, or by placing it in a location where the victim's application is expected to load files (e.g., a shared drive, an untrusted repository).
4. User/Application Interaction: The victim's application or user, believing the pickle file to be legitimate or benign, initiates the loading process of the untrusted pickle file using the vulnerable picklescan library.
5. Vulnerable Deserialization: During the deserialization process, the picklescan library invokes numpy.f2py.crackfortran functions. Due to the CVE-2025-71362 vulnerability, these functions call eval on the arbitrary malicious strings embedded within the pickle file.
6. Arbitrary Code Execution: The eval call executes the attacker's embedded malicious code within the context of the vulnerable application, leading to arbitrary code execution on the host system.
7. Impact on System: With arbitrary code execution, the attacker can achieve various objectives, such as data exfiltration, installation of malware, establishment of persistence, or full system compromise.

Impact

The successful exploitation of CVE-2025-71362 allows for arbitrary code execution on the system running the vulnerable picklescan instance. This means an attacker could gain full control over the affected system, potentially leading to complete data compromise, installation of ransomware, deployment of backdoors, or lateral movement within the network. While specific victim counts or targeted sectors are not detailed in the NVD advisory, any organization or developer using affected versions of picklescan to process untrusted Python pickle files is at risk. The consequences range from data breach and operational disruption to severe reputational damage.

Recommendation

• Patch CVE-2025-71362: Immediately upgrade picklescan to version 0.0.33 or later to mitigate CVE-2025-71362.
• Implement Input Validation: Ensure that all pickle files processed by applications are from trusted sources and implement strict validation before deserialization.
• Isolate Processing: If processing untrusted pickle files is unavoidable, perform the deserialization in a highly isolated environment (e.g., a secure sandbox or virtual machine) to contain potential arbitrary code execution.

Attack Chain

1. An attacker crafts a malicious Python pickle file containing arbitrary code, leveraging the idlelib.calltip.get_entity function within the pickle's __reduce__ method to embed their payload.
2. The attacker distributes this specially crafted pickle file to a target system, potentially through email attachments, untrusted file downloads, or as part of a compromised data exchange.
3. A victim receives and attempts to process or scan the untrusted pickle file using an affected version of the picklescan library (prior to 0.0.29).
4. The picklescan library, when performing its security checks, fails to correctly identify and flag the malicious code embedded via idlelib.calltip.get_entity.
5. The malicious pickle file is then loaded or deserialized by a Python application or script on the victim's system.
6. During the deserialization process, the embedded code within the pickle file executes, leading to arbitrary remote command execution on the victim's system, granting the attacker control.

Impact

Successful exploitation of CVE-2025-71360 leads to arbitrary remote code execution on the victim's system. This can result in complete system compromise, allowing attackers to install malware, exfiltrate sensitive data, establish persistence, or pivot to other systems within the network. Organizations relying on picklescan for validating untrusted data could be unknowingly processing malicious content, leading to widespread compromise. The direct impact is the subversion of a security control, enabling attackers to bypass detection and execute their payloads.

Recommendation

• Immediately update picklescan to version 0.0.29 or newer to remediate CVE-2025-71360.
• Implement strict controls around the handling and loading of Python pickle files, treating all external or untrusted pickle files as potentially malicious.
• Educate users and developers on the dangers of deserializing untrusted data and the importance of using secure deserialization alternatives or strict validation.
• Consider deploying application-level sandboxing or isolation for processes that handle pickle file deserialization to limit the impact of potential RCE.

Attack Chain

1. An attacker crafts a malicious Python pickle file containing a specially constructed torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression call that includes arbitrary code.
2. The attacker delivers this malicious pickle file to a target system, potentially via email, compromised data repositories, or untrusted downloads.
3. A Python application on the victim's system attempts to load or process the pickle file.
4. If the picklescan library is used to scan the file for malicious content, it fails to detect the embedded arbitrary code within the torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression call.
5. During the standard Python pickle deserialization process, the vulnerable evaluate_guards_expression call is executed.
6. The embedded arbitrary code payload is then executed on the victim's system, leading to remote code execution, granting the attacker control over the compromised system.

Impact

Successful exploitation of CVE-2025-71356 can lead to complete system compromise through remote code execution. Victims, particularly those in data science, machine learning, and AI sectors that frequently handle pickle files from various sources, are at risk. Attackers could exploit this to deploy ransomware, establish backdoors, steal sensitive intellectual property, or use the compromised system as a pivot point for further network penetration. The undetected nature of the malicious code within the pickle file bypasses security controls, making this a high-impact vulnerability.

Recommendation

• Upgrade picklescan to version 0.0.28 or later immediately to mitigate CVE-2025-71356.
• Implement strict input validation and source verification for all Python pickle files loaded in your environment, especially those originating from untrusted sources, even after upgrading picklescan.
• Review your software supply chain for components that use or process pickle files to identify and update any vulnerable instances of picklescan.

Attack Chain

1. Payload Crafting: An attacker crafts a malicious Python pickle file, embedding a call to numpy.f2py.crackfortran.param_eval with attacker-controlled arguments within the pickle's reduce method.
2. Delivery: The attacker delivers the specially crafted malicious pickle file to a target system. This delivery can occur via various means such as email attachments, file downloads, or through compromised data repositories.
3. Defense Bypass: If the target system uses picklescan versions prior to 0.0.33 to inspect the file, the vulnerability (CVE-2025-71347) causes picklescan to fail to detect the malicious code embedded via numpy.f2py.crackfortran.param_eval.
4. Execution Trigger: A vulnerable application on the victim's system, designed to process Python pickle data, attempts to load and deserialize the untrusted, now undetected, malicious pickle file.
5. Arbitrary Code Execution: During the deserialization process, the embedded numpy.f2py.crackfortran.param_eval function is invoked by the Python interpreter, leading to the execution of arbitrary code defined by the attacker.
6. Impact: The attacker gains control over the application's process with the privileges of the running application, potentially allowing for data exfiltration, further system compromise, or persistence.

Impact

Successful exploitation of CVE-2025-71347 results in arbitrary code execution, enabling attackers to fully compromise the affected application and potentially the underlying system. This can lead to sensitive data exfiltration, installation of additional malware, privilege escalation, and complete control over the compromised environment. While the NVD advisory does not specify observed victims or targeted sectors, any organization that uses picklescan to validate Python pickle files or deserializes untrusted pickle data is at risk of severe impact, including financial loss, operational disruption, and reputational damage.

Recommendation

• Upgrade picklescan to version 0.0.33 or later immediately to patch CVE-2025-71347.
• Implement strict input validation and deserialization policies to prevent applications from loading untrusted pickle files, even if scanned by older picklescan versions.
• Refer to the advisory links provided in the references section for more detailed information about CVE-2025-71347 and mitigation strategies.
• Ensure all applications processing pickle data are isolated in sandboxed environments to minimize the blast radius of potential arbitrary code execution.

Attack Chain

The provided source describes a vulnerability in picklescan's detection capabilities rather than a multi-stage attack chain in the wild. The exploitation scenario primarily involves the delivery and deserialization of a specially crafted malicious file. Therefore, a multi-step attack chain as observed in active campaigns cannot be accurately constructed from this information.

However, the core exploitation flow is as follows:

1. Initial Access: An attacker delivers a malicious pickle file to a victim system (e.g., via email, download from an untrusted source, or compromised data pipeline).
2. Defense Evasion (Bypass picklescan): The malicious pickle file is crafted to invoke the torch.utils.bottleneck.__main__.run_autograd_prof function, which picklescan versions < 0.0.30 fail to identify as malicious.
3. Deserialization: The victim application or system attempts to load and deserialize the seemingly benign pickle file, potentially after a failed picklescan check.
4. Arbitrary Code Execution: During the deserialization process, the embedded malicious code within the pickle file is executed in the context of the application.
5. Impact: The executed code performs actions determined by the attacker, such as system compromise, data exfiltration, or further malware deployment.

Impact

The successful exploitation of CVE-2025-71345 results in unauthenticated remote code execution on systems that process untrusted pickle files with vulnerable versions of picklescan. This allows attackers to bypass security measures, gain full control over the affected system, steal sensitive data, deploy ransomware, or establish persistence within the network. The vulnerability has a CVSS v3.1 base score of 8.1 (High), underscoring the severe consequences of exploitation, particularly in environments handling machine learning models or other serialized Python objects where picklescan is deployed for security scanning.

Recommendation

• Patch CVE-2025-71345 immediately: Update picklescan to version 0.0.30 or newer to mitigate the vulnerability and ensure proper detection of malicious pickle files.
• Implement Secure Deserialization Practices: Restrict the deserialization of pickle files from untrusted or unverified sources, as described by CWE-502.
• Educate Users: Train users and developers about the risks associated with handling untrusted serialized data, including pickle files.

Attack Chain

1. Attacker crafts a malicious Python pickle file containing arbitrary code, specifically exploiting the lib2to3.pgen2.pgen.ParserGenerator.make_label function's reduce method to bypass picklescan's detection.
2. The malicious pickle file is delivered to a target system, potentially through methods such as email attachments, malicious web downloads, or integration into a compromised software supply chain.
3. An application or user on the target system processes or scans the received pickle file using picklescan version prior to 0.0.30.
4. Due to CVE-2025-71343, picklescan fails to identify the embedded malicious payload, incorrectly marking the file as benign.
5. A Python application or script on the target system subsequently loads the "undetected" malicious pickle file using pickle.load().
6. During the deserialization process, the embedded arbitrary code within the pickle file is executed in the context of the Python application.
7. The attacker achieves arbitrary command execution on the compromised system, potentially leading to full system compromise, data exfiltration, or further lateral movement.

Impact

The successful exploitation of CVE-2025-71343 allows an attacker to achieve arbitrary code execution on systems that process untrusted pickle files using vulnerable versions of picklescan. This can lead to complete system compromise, unauthorized access to sensitive data, installation of malware, or disruption of services. While no specific victim counts are provided, any organization or individual processing Python pickle files in environments where picklescan is used for security vetting (especially in data science, machine learning, or software development contexts) is at risk. The undetected nature of the attack makes it particularly dangerous, as security tools designed to prevent such threats are bypassed.

Recommendation

• Update picklescan to version 0.0.30 or later immediately to patch CVE-2025-71343 and address the detection bypass vulnerability.
• Implement strict controls on the ingestion and processing of untrusted pickle files, regardless of picklescan's output, especially from external or unverified sources.
• Educate users and developers about the risks associated with deserializing untrusted data, specifically in the context of Python pickle files, to prevent arbitrary code execution (CWE-502).

Attack Chain

1. An attacker crafts a specially designed Python pickle file containing arbitrary code.
2. The malicious code is embedded within the pickle file's reduce methods, specifically leveraging idlelib.run.Executive.runcode to obscure its true intent.
3. The attacker then distributes this malicious pickle file, potentially by injecting it into a software supply chain (e.g., a shared machine learning model repository).
4. A victim system or application, such as a PyTorch model loader, downloads or receives the compromised pickle file.
5. The application attempts to deserialize the pickle file using Python's pickle.load() function.
6. During the deserialization process, picklescan (if present and vulnerable, i.e., version < 0.0.30) fails to identify the idlelib.run.Executive.runcode as a malicious primitive.
7. The embedded arbitrary code within the pickle file's reduce methods is consequently executed by the Python interpreter on the victim's system.
8. This results in remote code execution (RCE), allowing the attacker to compromise the host system and potentially exfiltrate data or establish persistence.

Impact

The successful exploitation of CVE-2025-71342 carries severe consequences, primarily remote code execution (RCE) with a CVSS v3.1 base score of 8.1 (High severity). This vulnerability can lead to complete compromise of the affected system's confidentiality and integrity, as attackers gain the ability to execute arbitrary commands. The primary risk lies in supply chain attacks, where malicious pickle files can be distributed through legitimate channels, infecting numerous downstream users. PyTorch models, often distributed as pickle files, are particularly vulnerable, meaning that compromised models could propagate malware to researchers, developers, and production systems globally, leading to widespread data theft, system sabotage, or further network penetration.

Recommendation

• Immediately update picklescan to version 0.0.30 or later to remediate CVE-2025-71342.
• Implement strict validation and sandboxing for deserialization of Python pickle files, especially those from untrusted or external sources.
• Educate development teams on the risks associated with deserializing untrusted data, specifically in the context of CVE-2025-71342 and pickle.load.
• Review existing practices for handling and loading machine learning models (e.g., PyTorch models) to ensure only verified and scanned pickle files are processed.