CVE-2025-71344: picklescan RCE via Undetected ensurepip._run_pip

Technical summary

The vulnerability stems from incomplete built-in function detection in picklescan's opcode analysis. Specifically, ensurepip._run_pip, a legitimate but dangerous Python standard library function, is not blacklisted or flagged during pickle scanning. Malicious actors can embed calls to this function within pickle object __reduce__ methods, leveraging pickle's protocol to automatically invoke arbitrary callables during deserialization. Because picklescan does not detect this particular function signature, files containing ensurepip._run_pip calls pass validation and execute unrestricted when pickle.load() is invoked. This bypasses the entire purpose of the scanning tool and creates a false sense of security for downstream applications.

Business impact

For organizations relying on picklescan to validate untrusted pickle data, this vulnerability undermines core security assumptions. Development and DevOps teams may be unaware that their pickle scanning is incomplete, leading to deployment of applications that appear protected but are actually exposed to remote code execution. If untrusted pickle files are processed—such as from user uploads, API payloads, or cached data sources—attackers can achieve full code execution with the privileges of the application process. Incident response costs, data exfiltration risk, and supply chain contamination become serious concerns for affected systems.

Affected systems

Any Python application using picklescan version 0.0.26 or earlier to validate pickle files is vulnerable. This includes systems that load pickles from external sources (web uploads, API calls, databases, or inter-service communication). The vulnerability is particularly acute in microservices architectures, machine learning pipelines, and data serialization workflows where pickle deserialization is common. Organizations running picklescan in CI/CD pipelines to validate model or data artifacts are also at risk if they have not yet upgraded to version 0.0.30 or later.

Exploitability

Exploitation requires an attacker to craft a malicious pickle file containing an ensurepip._run_pip call and deliver it to a target application that uses vulnerable picklescan. The attack requires user interaction only to the extent that the application must attempt to load and validate the pickle file—a common operation in many automated systems. The CVSS vector (AV:N/AC:L/PR:N/UI:R) reflects that the attack is network-accessible with low complexity and requires only that a user or automated system interact with the malicious file. No authentication or special privileges are needed to trigger the vulnerability. Given the ubiquity of pickle usage in Python applications, the attack surface is substantial.

Remediation

Upgrade picklescan to version 0.0.30 or later, which addresses the detection gap by properly identifying ensurepip._run_pip and other similar built-in functions. Organizations should audit their current picklescan deployment versions across development, testing, and production environments. Additionally, implement defense-in-depth measures: avoid loading pickles from untrusted sources where possible, enforce strict network segmentation for services that do, run pickle-loading processes with minimal privileges, and consider using safer serialization formats (e.g., JSON) when pickle is not strictly necessary.

Patch guidance

Update picklescan to version 0.0.30 or later. Verify the upgrade by checking the installed version with pip show picklescan or inspecting your environment's dependency lock file. If using picklescan as a CI/CD scanning tool, update the tool version in your pipeline configuration and re-validate previously scanned artifacts with the new version to ensure no malicious files were missed. Test the upgraded version in a staging environment to confirm compatibility with your pickle validation workflows before rolling out to production systems.

Detection guidance

Search your codebase and container images for picklescan imports or installations to identify affected services. Use pip freeze, requirements.txt, poetry.lock, or equivalent dependency manifests to determine current versions. Monitor logs from pickle-loading applications for unusual process spawning or network connections that might indicate exploitation. Network-based detection is challenging without deep packet inspection, but behavioral anomalies (unexpected subprocess creation, pip package downloads) following pickle deserialization should trigger investigation. Consider adding explicit logging around pickle.load() calls to track which files are being deserialized and from which sources.

Why prioritize this

This vulnerability merits immediate attention because it directly undermines a security control (picklescan) that organizations may rely on to mitigate pickle deserialization risks. The HIGH CVSS score (8.1) reflects the combination of network accessibility, high impact on confidentiality and integrity, and low attack complexity. Unlike vulnerabilities in rarely-used libraries, picklescan is a dedicated security tool, so its failure has concentrated impact on systems that explicitly trust it. The fact that it is not yet in CISA's KEV catalog does not diminish urgency—patching should be treated as critical.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) accounts for: network-accessible attack vector (AV:N), low attack complexity (AC:L), no privilege requirements (PR:N), limited user interaction (UI:R), high impact on confidentiality (C:H) and integrity (I:H), and no impact on availability (A:N). The score appropriately captures the severity of unauthenticated remote code execution. The UI:R component reflects that an application or user must load the pickle file, which is a weak constraint in automated environments but a realistic one. The absence of availability impact reflects that RCE typically allows an attacker to maintain access rather than disrupt service.

Frequently asked questions