CVE-2025-71348: picklescan Detection Evasion in Torch Config Loading

Technical summary

CVE-2025-71348 is a detection evasion vulnerability in picklescan versions before 0.0.28. The vulnerability stems from incomplete coverage of code execution paths in Python pickle deserialization. Specifically, picklescan fails to detect or block the instantiation of torch.utils._config_module.load_config within reduce method constructs. During pickle.load(), Python's pickle protocol invokes these reduce methods, allowing arbitrary code execution. The vulnerability is rooted in CWE-502 (Deserialization of Untrusted Data) and represents a fundamental gap in picklescan's threat model—it cannot comprehensively block all execution vectors in the pickle format.

Business impact

Organizations using picklescan as a security control for processing untrusted pickle files face a critical trust boundary violation. Because picklescan is often deployed in data pipelines, model serving infrastructure, or other supply chain integration points, attackers can distribute poisoned pickle artifacts that appear safe to automated scanners but execute malicious code upon deserialization. This undermines the entire defensive posture around pickle handling and could lead to supply chain compromise, unauthorized data access, or lateral movement within infrastructure that relies on picklescan clearance.

Affected systems

picklescan versions prior to 0.0.28 are affected. Any downstream system, tool, or workflow that integrates picklescan for threat detection—including machine learning frameworks, data processing pipelines, and automated model repositories—inherits the vulnerability. The vulnerability also affects any organization or developer trusting picklescan output to gate the loading of pickle objects from external sources.

Exploitability

This vulnerability requires user interaction (loading a pickle file), but exploitation is straightforward once a malicious pickle is introduced into a supply chain. No special privileges or authentication are needed. The attacker's main effort is crafting a pickle file that embeds torch.utils._config_module.load_config in a way that picklescan does not recognize, then distributing it through a trusted channel (e.g., a model hub, package repository, or shared data store). The CVSS vector (AV:N/AC:L/PR:N/UI:R) reflects the network-based distribution and low complexity of crafting such payloads.

Remediation

Upgrade picklescan to version 0.0.28 or later immediately. This update closes the detection gap for torch.utils._config_module.load_config and related code paths in pickle reduce methods. Additionally, implement defense-in-depth: consider sandboxing or containerizing pickle deserialization operations, enforce strict origin verification for pickle files, and monitor for unexpected subprocess or network activity during deserialization. Organizations should audit their supply chain for any pickles processed by vulnerable picklescan versions in the past.

Patch guidance

Update picklescan to 0.0.28 or any subsequent version. Consult the project's release notes and repository (mmaitre314/picklescan) to confirm patch availability and any breaking changes. Verify the update in your package management system (pip, conda, or equivalent) before deploying to production. Given the supply-chain-attack vector, prioritize patching in any environment where picklescan gates untrusted pickle loading.

Detection guidance

Monitor for pickle deserialization events in your infrastructure, particularly those involving torch or other ML framework dependencies. Log any instances where picklescan output was trusted but subsequent execution or network behavior suggests unexpected code ran. Review git history or artifact repositories for pickle files processed by picklescan versions prior to 0.0.28. Consider using static analysis tools or alternative pickle sanitizers (e.g., restricted unpicklers) alongside picklescan going forward. Network-based detection should flag unusual torch module instantiation or config-loading patterns in serialized data.

Why prioritize this

This is a HIGH severity vulnerability (CVSS 8.1) in a security-critical component—a scanner meant to *prevent* arbitrary code execution. Its exploitation directly undermines a trust boundary and enables supply-chain attacks. Although no public exploit or active KEV listing exists yet, the detection evasion nature and straightforward attack surface make it a prime target for adversaries. Any organization relying on picklescan for threat detection should treat this as immediate priority.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects high confidentiality and integrity impact (arbitrary code execution), network-based attack vector, low attack complexity, and no special privileges required. The user interaction requirement (loading a pickle) prevents a perfect score, but in supply-chain contexts, social engineering or automated workflows can satisfy this. The score appropriately penalizes the fact that picklescan is a *security tool*—its compromise has amplified trust implications compared to a regular library.

Frequently asked questions