CVE-2025-71322: PickleScan Unsafe Globals Bypass – pty.spawn RCE Vulnerability

Technical summary

CVE-2025-71322 exploits an incomplete unsafe globals configuration in PickleScan's sandboxing mechanism. PickleScan uses a whitelist approach to define which functions and modules are permitted when unpickling data. The pty.spawn function, which provides low-level process spawning capabilities, was omitted from the unsafe globals list prior to version 0.0.33. Attackers craft pickle objects that reconstruct and invoke pty.spawn directly, bypassing the intended security controls. This falls under CWE-693 (Protection Mechanism Failure), indicating a flaw in the tool's core defense architecture. The CVSS 3.1 score of 8.8 (HIGH) reflects the complete compromise potential: network-exploitable with low complexity, no authentication required, and direct impact to confidentiality, integrity, and availability.

Business impact

Organizations using PickleScan to validate untrusted pickle data face immediate risk of complete system compromise. If PickleScan is integrated into data pipelines, threat detection systems, or automated file processing workflows, a single malicious pickle file can lead to unauthorized code execution with the privileges of the process running PickleScan. This may result in data exfiltration, lateral movement, ransomware deployment, or supply chain contamination if the affected system handles third-party data. The vulnerability undermines the trust placed in PickleScan as a security boundary.

Affected systems

PickleScan versions prior to 0.0.33 are vulnerable. The vendor products list in the source data is empty, suggesting PickleScan may be a standalone utility rather than a bundled component. Organizations should audit their environment for PickleScan installations and verify version numbers. Any automated process that uses PickleScan to scan or validate pickle files from untrusted sources is at risk.

Exploitability

Exploitability is high. The attack vector is network-based (CVSS AV:N), requires no special privileges (PR:N), and has low complexity (AC:L). However, user interaction (UI:R) is required—an attacker must convince someone to process a malicious pickle file through PickleScan. Proof-of-concept development would be straightforward for a skilled attacker familiar with Python pickle internals and pty.spawn semantics. No known public exploits are listed in the KEV catalog, but the simplicity of the vulnerability makes weaponization likely once widely disclosed.

Remediation

Upgrade PickleScan to version 0.0.33 or later immediately. The patch adds pty.spawn to the unsafe globals list, restoring the intended security boundary. There are no known workarounds for earlier versions; patching is the only reliable mitigation. Organizations should also review where PickleScan fits into their data validation architecture and consider defense-in-depth measures such as sandboxing the PickleScan process itself or applying additional validation layers.

Patch guidance

Apply PickleScan version 0.0.33 or later. Consult the official PickleScan repository or release notes to confirm the patch is available in your distribution channel. Test the upgrade in a non-production environment first to ensure compatibility with existing workflows. After deployment, verify that PickleScan correctly rejects pickle files that attempt to use pty.spawn or related process-spawning functions. Monitor for any error logs indicating blocked execution attempts.

Detection guidance

In PickleScan logs, look for error messages indicating blocked or rejected pty.spawn calls after upgrading. If you are still running a vulnerable version, detection is difficult because the bypass succeeds silently. To identify exposure, check for unexpected process spawning or outbound connections from processes running PickleScan. Audit pickle files in your data pipelines for suspicious opcode sequences (GLOBAL instructions referencing pty.spawn). Consider deploying file integrity monitoring and process execution monitoring around PickleScan deployments to catch exploitation attempts.

Why prioritize this

This is a high-priority patch due to the complete bypass of a security-critical function, the low complexity of exploitation, and the absence of authentication or special privileges required. Any organization relying on PickleScan as a trust boundary for untrusted pickle data should treat this as urgent. However, the requirement for user interaction (delivering a malicious file) slightly reduces priority compared to fully remote, unauthenticated worm-capable flaws.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects a high-severity vulnerability with direct impact to all three security properties (confidentiality, integrity, availability). The low attack complexity and lack of authentication requirements drive the high score. The network attack vector acknowledges that pickle files can be delivered remotely. The user interaction requirement (UI:R) prevents a perfect 9.8 score but does not materially lower the risk given the ease of social engineering or inadvertent processing of untrusted data.

Frequently asked questions