CVE-2025-71345: Picklescan Deserialization Bypass Enables RCE via PyTorch Gadget

Technical summary

The vulnerability stems from an incomplete detection signature in picklescan's malicious payload scanner. Pickle files are a Python serialization format that can execute arbitrary code during deserialization if they contain references to callable functions and objects. Picklescan is designed to parse pickle bytecode and identify known dangerous patterns before unsafe deserialization occurs. However, the tool does not recognize the torch.utils.bottleneck.__main__.run_autograd_prof function as a gadget chain endpoint, meaning a carefully crafted pickle can invoke this function with attacker-controlled arguments. Since run_autograd_prof can execute shell commands or load arbitrary code, this creates a code execution pathway that bypasses picklescan's validation. The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data), the canonical weakness for pickle-based RCE. The CVSS 3.1 score of 8.1 (HIGH) reflects the network-exploitable nature (AV:N), lack of required privileges (PR:N), and user interaction (UI:R—a user or application must deserialize the pickle), resulting in high confidentiality and integrity impact but no direct availability impact.

Business impact

Any organization using picklescan as a security control to block untrusted pickle files is operating under a false sense of security. If an attacker can trick a user or system into opening a specially crafted pickle file—via email, compromised repository, or supply chain injection—the attacker gains code execution with the privileges of the deserializing application or user. For data science teams, ML pipeline operators, and software supply chains that exchange pickle-serialized models, this is a significant risk vector. The impact extends beyond direct code execution: compromised systems could be used to exfiltrate training data, poison models, or pivot to other network resources.

Affected systems

Picklescan versions before 0.0.30 are affected. Any system or application that uses picklescan to validate pickle files is exposed. This includes: ML development environments, data pipeline tools, model distribution systems, and any Python application that deserializes untrusted pickle data and relies on picklescan for protection. The vulnerability does not affect picklescan users on version 0.0.30 or later. PyTorch installations are not directly vulnerable; the vulnerability exists in the gap between picklescan's detection and PyTorch's available gadget chains.

Exploitability

Exploitation requires user interaction—a target must deserialize the malicious pickle file. However, user interaction can be social engineering (opening an attachment), automated in CI/CD pipelines, or embedded in reproducible research workflows where pickle files are routine. The attack surface is broad because pickle files are lightweight, portable, and widely used in data science. An attacker needs no special privileges or complex setup; crafting a malicious pickle using standard Python libraries and then encoding the torch.utils.bottleneck.__main__.run_autograd_prof gadget is straightforward for someone familiar with pickle internals. The barrier to weaponization is moderate but well within the capability of targeted attackers.

Remediation

Upgrade picklescan to version 0.0.30 or later, which includes detection signatures for the torch.utils.bottleneck.__main__.run_autograd_prof gadget. Beyond the patch, implement defense-in-depth: (1) Avoid deserializing pickle files from untrusted sources; prefer safer serialization formats like JSON or Protocol Buffers. (2) Run deserialization in sandboxed or containerized environments with minimal privileges. (3) Use network-level controls to block outbound connections from processes that deserialize untrusted data. (4) Monitor logs for suspicious pickle deserialization or unexpected child process spawning.

Patch guidance

Verify the picklescan release notes and repository to confirm version 0.0.30 or later is available for your deployment. Update via your package manager (pip install --upgrade picklescan or equivalent). After patching, test that picklescan correctly rejects a known-malicious pickle file using the torch.utils.bottleneck.__main__.run_autograd_prof gadget to confirm detection signatures are active. No version pinning or rollback should occur; older versions must be removed from any distribution or dependency trees.

Detection guidance

Intrusion detection systems (IDS) should flag any deserialization of pickle files containing references to torch.utils.bottleneck.__main__.run_autograd_prof or similar PyTorch gadgets. Endpoint detection and response (EDR) tools can monitor for suspicious child processes spawned immediately after pickle deserialization, particularly shell invocations (cmd.exe, /bin/sh). Application-level logging: enable Python-level warnings or hooks to log all pickle deserialization attempts, including the file source and content hash. Network-level detection: monitor for unusual outbound connections or DNS queries from systems that have recently processed pickle files. Threat hunting: scan code repositories and data lakes for pickle files containing the vulnerable gadget chain; use pickle inspection tools like pickletools.dis() to audit file contents.

Why prioritize this

Prioritize this vulnerability for immediate patching in any environment where picklescan is deployed as a primary defense mechanism, especially in ML/data science teams and supply chains. The HIGH CVSS score combined with the fact that the vulnerable tool is a security control creates a compounding risk: attackers specifically target security tools to achieve bypass. While KEV status is not yet assigned, the straightforward nature of exploitation and the high impact warrant treatment as critical within your organization if picklescan is in use.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects: (1) Network-exploitable attack vector—pickle files can be delivered remotely via email, web, or supply chain. (2) Low attack complexity—no advanced techniques required; pickle gadgets are documented and reproducible. (3) No privilege requirement—the attacker does not need an existing account or elevated access. (4) User interaction required—a user or automated process must deserialize the pickle, which is typical in data pipelines and model distribution. (5) High confidentiality and integrity impact—arbitrary code execution allows data theft and system compromise. (6) No availability impact is assumed, though actual impact may include denial of service if the RCE payload includes destructive actions. The score would be higher if authentication were not required for file delivery, but remains high because user interaction is a weak control in practice.

Frequently asked questions