CVE-2025-71349: picklescan Undetected Code Execution via trace.Trace.run

Technical summary

picklescan is a static analysis tool that inspects pickle serialization files for potentially dangerous bytecode operations before deserialization. The vulnerability stems from incomplete coverage of dangerous callable objects during analysis. Specifically, picklescan fails to identify trace.Trace.run as a dangerous builtin function that can be exploited via the pickle reduce protocol. An attacker can craft a pickle file that uses trace.Trace.run in its reduce method, bypassing picklescan's detection logic. When pickle.load deserializes the file, the reduce method executes arbitrary code with the privileges of the Python process. This is a classic unsafe deserialization issue (CWE-502) compounded by incomplete detection in the security scanner itself. Versions 0.0.29 and later address this by adding trace.Trace.run to the list of dangerous functions.

Business impact

Organizations relying on picklescan to prevent deserialization attacks face a critical gap in their defensive posture. If picklescan is used as a gating mechanism for processing untrusted pickle files—such as in data pipelines, machine learning model loading, or inter-service communication—attackers can circumvent it entirely. The business impact depends on exposure: data scientists loading untrusted models, API services deserializing pickled objects, or distributed systems passing serialized data between components are all at elevated risk. A successful exploit leads to arbitrary code execution, enabling data theft, system compromise, lateral movement, and supply chain attacks.

Affected systems

The vulnerability affects picklescan versions before 0.0.29. Any organization using an older version to validate pickle files is vulnerable. The exposure extends to systems that rely on picklescan as a security control, including Python-based applications that process untrusted pickle data, machine learning platforms that load external models, and data infrastructure that deserializes pickled objects. The severity is heightened in environments where picklescan is trusted as a primary defense against deserialization attacks.

Exploitability

Exploitability is moderate to high. The vulnerability requires an attacker to craft a malicious pickle file and deliver it to a target who will deserialize it—whether via email, file sharing, a compromised model repository, or other means. There is no network-direct exploitation; user interaction is required to load the file. However, the bar for weaponization is low: an attacker with basic Python knowledge can construct a pickle file that embeds trace.Trace.run in the reduce method. Once the user or application calls pickle.load on the file, arbitrary code executes immediately. The attack is reliable and does not depend on race conditions or environment-specific quirks.

Remediation

Upgrade picklescan to version 0.0.29 or later immediately. This version includes fixes to detect trace.Trace.run and other previously-missed dangerous functions. After upgrading, re-scan any pickle files that were processed by older picklescan versions using the new release. For organizations without the ability to upgrade immediately, do not use picklescan as a sole security control for untrusted pickle files; implement additional mitigations such as sandboxing pickle deserialization, restricting file sources, and limiting pickle processing to trusted, verified data.

Patch guidance

Verify the current version of picklescan in your environment using pip show picklescan or equivalent package management tools. Update to version 0.0.29 or later using pip install --upgrade picklescan. Test the updated version in a non-production environment to ensure compatibility with your existing data pipelines and tooling. After patching, consider performing a retrospective audit of pickle files processed in recent months, especially those from external sources or untrusted origins, to detect any prior exploitation. Document the patch deployment for compliance and incident response records.

Detection guidance

Look for usage of picklescan in your codebase and infrastructure to identify which systems depend on it. Cross-reference installed versions against version 0.0.29. Monitor logs for calls to pickle.load or pickle.loads, particularly when processing external or user-supplied data. In threat hunting, look for unexpected process spawning or system calls originating from Python deserialization contexts—picklescan bypasses would manifest as code execution without obvious triggering events. Network-based detection is limited since the attack is file-based, but monitor for unusual file transfers targeting data scientists, ML engineers, or automated ML pipelines, especially if the files are pickle archives.

Why prioritize this

This vulnerability warrants immediate prioritization due to the combination of high CVSS score (8.1), complete authentication bypass, and the critical nature of deserialization security controls. The fact that picklescan is a purpose-built security tool heightens the impact of its failure—organizations believed they were protected when they were not. While exploitation requires user interaction, the attack is reliable, requires no special privileges, and delivers full code execution. In environments where picklescan is part of the security architecture for ML models, data processing, or untrusted input handling, this should be treated as a critical security gap.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects: (1) network-accessible attack vector—malicious pickle files can be delivered remotely; (2) low attack complexity—no special conditions required; (3) no privilege escalation needed; (4) high impact on confidentiality and integrity (attacker gains code execution); and (5) no direct impact on availability, hence the absence of the A parameter. The score accounts for required user interaction (opening the file), which prevents it from reaching CRITICAL status. However, in practical scenarios where pickle deserialization is automated or routine, the user interaction requirement becomes a minor barrier.

Frequently asked questions