CVE-2025-71341: Picklescan Bypass Enables Remote Code Execution via profile.Profile.runctx

Technical summary

CVE-2025-71341 exploits an incomplete detection mechanism in picklescan's analysis engine. The vulnerability stems from the tool's failure to recognize profile.Profile.runctx as a dangerous function when used within the reduce method of pickle serialization. By leveraging this blind spot, attackers can embed code execution primitives that bypass picklescan's inspection, resulting in remote code execution upon deserialization. The root cause is a gap in the function signature detection logic, allowing this specific gadget chain to slip through undetected.

Business impact

Organizations using picklescan as part of their input validation or threat detection pipeline for untrusted pickle data face a critical security regression. If picklescan is integrated into workflow automation, data pipeline security gates, or external data ingestion processes, attackers can bypass these controls entirely. The reputational and operational impact depends on whether the organization relies on picklescan as a primary defense; if it does, this vulnerability represents a complete failure of that control until patching occurs.

Affected systems

Any deployment running picklescan versions prior to 0.0.29 is vulnerable. This includes development environments, CI/CD pipelines, data analysis platforms, and any production systems that use picklescan to validate or scan pickle files before processing. The impact is particularly acute in data science and machine learning workflows where pickle deserialization is common but security controls may be limited.

Exploitability

Exploitation requires network delivery of a crafted pickle file and user interaction (opening or processing the file), making this a practical attack vector in scenarios involving email attachments, shared repositories, or web-based file uploads. The attack requires no authentication or special privileges on the target system. Proof-of-concept generation is straightforward for anyone familiar with Python pickle gadget chains, as the evasion technique is deterministic once the picklescan detection gap is understood.

Remediation

Upgrade picklescan to version 0.0.29 or later immediately. Verify the upgraded version is deployed across all systems, including development machines, CI/CD agents, and any containerized environments. Organizations should also conduct a brief inventory of where picklescan is relied upon as a security control and consider supplementary validation measures (e.g., sandboxed deserialization, deny-listing known gadget chains) during the transition period.

Patch guidance

Update picklescan via your package manager (pip install --upgrade picklescan) and verify the installed version is 0.0.29 or later using pip show picklescan. For containerized deployments, rebuild container images with the patched version and redeploy. For dependency-managed projects, update your lock file and rebuild. Test the upgrade in a non-production environment first to ensure compatibility with your specific pickle scanning workflows. No configuration changes are required post-patch.

Detection guidance

In the interim before patching, monitor for suspicious pickle file ingestion, particularly from external sources. Implement network-level controls to restrict pickle file transfers if possible. Enable logging on any systems where picklescan is invoked and look for processing of pickle files containing profile.Profile references or runctx method calls—though note that such logging may not be standard. Consider running pickle files in a sandboxed environment as an additional defensive layer while relying on picklescan for this version window.

Why prioritize this

This vulnerability merits immediate attention because it directly undermines a security tool's core function. If picklescan is deployed as a detection/prevention mechanism, this becomes a critical control failure. The high CVSS score (8.1) reflects the combination of network-accessible attack surface, no authentication requirement, and high-impact code execution, tempered only by the user interaction requirement. Organizations should treat this as a security control regression rather than a typical vulnerability patch.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) is driven by network-accessible attack vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), and high confidentiality and integrity impact (C:H, I:H). The requirement for user interaction (UI:R) prevents a perfect 9.0+ score. Organizations with high reliance on picklescan for untrusted input handling should treat this as functionally equivalent to a critical issue despite the CVSS rating.

Frequently asked questions