CVE-2025-71343: picklescan Detection Bypass Allows Remote Code Execution

Technical summary

CVE-2025-71343 exploits a gap in picklescan's detection logic by leveraging the lib2to3.pgen2.pgen.ParserGenerator.make_label function within the pickle reduce method. Pickle's reduce protocol allows objects to specify custom deserialization behavior. By embedding malicious code in a way that invokes make_label during unpickling, an attacker can bypass picklescan's static analysis and execute arbitrary Python code. The vulnerability affects all picklescan versions prior to 0.0.30. The root cause is insufficient coverage of code paths that can be weaponized during object reconstruction, allowing gadget chains to go undetected.

Business impact

Organizations using picklescan to validate untrusted pickle data—such as those processing serialized data from external sources, ML model artifacts, or cache files—face a critical trust boundary breach. A successful attack allows remote code execution with the privileges of the process running pickle.load(). This can compromise sensitive data, inject malicious model weights, poison ML pipelines, or establish persistence. The impact is compounded by picklescan's role as a security control; organizations may have reduced their defensive posture, assuming picklescan provides reliable protection.

Affected systems

picklescan versions before 0.0.30 are affected. Any application or workflow that uses picklescan to validate pickle files before deserialization is at risk. This includes Python applications processing untrusted serialized objects, data science platforms, machine learning model repositories, and microservices that accept pickle-based inter-process communication. Organizations using picklescan as part of a security scanning pipeline are particularly exposed.

Exploitability

Exploitability is high. The attack requires user interaction (a user or process must call pickle.load() on the malicious file) but no authentication or special privileges. Crafting the malicious pickle file is feasible for a competent attacker with knowledge of Python's pickle protocol and the lib2to3 library internals. No special system configuration is required. The bypass is reliable and repeatable, making this suitable for targeted attacks on data pipelines or supply-chain scenarios where pickle files are exchanged.

Remediation

Upgrade picklescan to version 0.0.30 or later immediately. Organizations should prioritize this patch given picklescan's role as a security control. Beyond patching, implement defense-in-depth: restrict pickle deserialization from untrusted sources, enforce code signing and integrity checks on pickle files, isolate deserialization processes with sandboxing, and consider alternative serialization formats (JSON, Protocol Buffers, MessagePack) where feasible. Review logs for unexpected pickle.load() calls or picklescan version history to identify whether malicious files may have been processed pre-patch.

Patch guidance

Update picklescan from the official repository or package manager (e.g., PyPI) to version 0.0.30 or any later stable release. This patch specifically addresses the detection gap in the lib2to3.pgen2.pgen.ParserGenerator.make_label gadget chain. After patching, re-scan any pickle files that were processed before the upgrade using the patched version to confirm they are safe. Automated dependency management tools can help identify picklescan installations across your environment.

Detection guidance

Monitor for pickle.load() or pickle.loads() calls in your codebase, particularly those handling external or untrusted data. Review picklescan version numbers in requirements files and installed packages to ensure all instances are 0.0.30 or later. If you have packet capture or process monitoring, look for anomalous behavior (unexpected code execution, data exfiltration) immediately following deserialization of pickle files from external sources. Check for pickle files in your supply chain—caches, artifact repositories, model stores—and re-validate them with patched picklescan if they originated from untrusted sources during the vulnerable window.

Why prioritize this

This is a HIGH-severity vulnerability affecting a critical security tool. The impact is remote code execution with no authentication required, and the attack surface includes any use of picklescan in a validation pipeline. Although user interaction is required to trigger the payload, the nature of picklescan's deployment (as an automated security control) means pickle files may be deserialized in batch processes or automated workflows, reducing the practical friction for an attacker. Immediate patching is strongly recommended.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects a high-severity remote code execution vulnerability with a low attack complexity. The attack vector is network-based (an attacker sends a malicious pickle file), no privileges are required, and the confidentiality and integrity impacts are high (arbitrary code execution). The absence of availability impact (no denial of service) prevents a critical score. The score appropriately captures the severity of a detection bypass in a security-critical tool.

Frequently asked questions