CVE-2025-71350: Picklescan Detection Bypass via torch.utils.collect_env.run

Technical summary

CVE-2025-71350 is a detection bypass vulnerability in picklescan before version 0.0.28 affecting CWE-502 (Deserialization of Untrusted Data). The vulnerability stems from incomplete inspection logic in reduce method handling. Specifically, picklescan fails to detect when the torch.utils.collect_env.run function is invoked within pickle reduce sequences. Reduce methods are a standard pickle mechanism for reconstructing objects and are a known attack surface for code injection. An attacker can leverage this gap to embed malicious payloads that remain undetected by picklescan's scanning engine, only executing when the pickle file is deserialized by a victim application. The CVSS 3.1 score of 8.1 (HIGH) reflects network exploitability, low complexity, and the ability to achieve both confidentiality and integrity compromise.

Business impact

Organizations relying on picklescan as a defensive control against pickle deserialization attacks face a critical trust gap. If picklescan is used to validate pickle files before processing—a common pattern in data science pipelines, ML model distribution, and inter-service communication—this bypass allows malicious payloads to slip through validation and execute with the privileges of the application loading the pickle. The impact extends beyond direct code execution: attackers could exfiltrate sensitive training data, modify models, pivot laterally within networks, or establish persistence. Teams using picklescan in production should treat this as a high-priority remediation to maintain the integrity of their security posture.

Affected systems

Picklescan versions prior to 0.0.28 are affected. Any application or pipeline that uses picklescan to validate pickle files before deserialization is potentially at risk if it processes attacker-controlled pickle data. This includes machine learning workflows, data processing services, model serving platforms, and any system that deserializes pickles from external sources. The vulnerability does not affect systems that do not use picklescan or those that have already upgraded to 0.0.28 or later.

Exploitability

Exploitation is relatively straightforward from a technical standpoint. An attacker needs only to craft a malicious pickle file using the torch.utils.collect_env.run function within a reduce method, which is a documented and widely-known technique in pickle exploitation. The attack requires user interaction in the sense that a victim must load or process the pickle file, but this is a low bar in automated systems. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network accessibility and requires minimal interaction, making this a practical attack vector. No exploit code or detailed PoC should be circulated before patching is widespread.

Remediation

Upgrade picklescan to version 0.0.28 or later immediately. This version includes fixes to properly detect malicious use of torch.utils.collect_env.run and similar functions within reduce methods. After patching, validate that your scanning logic is working as expected by testing against known pickle payloads in a controlled environment. Review any pickle files processed during the window of vulnerability to determine if malicious activity occurred.

Patch guidance

Update picklescan to 0.0.28 or later via your package manager (pip install --upgrade picklescan). Verify the upgrade completed successfully by checking the version: 'picklescan --version' should report 0.0.28 or higher. If picklescan is vendored or embedded in an application, coordinate with the application vendor to obtain an update that includes the patched picklescan library. Test the patched version against your existing pickle file validation workflows to ensure no regression.

Detection guidance

Monitor for suspicious pickle file processing in your environment, particularly files from untrusted sources or with unexpected origins. Look for process execution following pickle deserialization, especially remote command execution or child process spawning. Network-based detection should flag attempts to download or stage pickle files to systems known to deserialize them. Endpoint detection and response (EDR) tools should alert on python or torch processes executing shell commands immediately after pickle operations. Review access logs for any pickle files processed during the vulnerable window and correlate with suspicious system activity.

Why prioritize this

This vulnerability merits immediate attention because it directly undermines a control mechanism (picklescan) that security teams rely on to block deserialization attacks. The high CVSS score (8.1) reflects the severity, and the ease of exploitation means active adversaries could quickly adopt this technique. Organizations in ML, data engineering, and any field processing untrusted pickle data should prioritize remediation within their next maintenance window. The bypass nature—rather than a new vector—makes this particularly risky because it may have already been exploited in the wild.

Risk score, explained

The CVSS 3.1 score of 8.1 is driven by: Network accessibility (AV:N) allowing remote exploitation, low attack complexity (AC:L) requiring no special conditions, no privilege requirements (PR:N), user interaction required (UI:R) for the victim to load the pickle, and high impact on both confidentiality and integrity (C:H/I:H) via code execution. Availability is not impacted (A:N). The score appropriately reflects a high-severity, remotely exploitable vulnerability with significant compromise potential, though it stops short of critical due to the requirement that a victim actively deserialize the malicious pickle file.

Frequently asked questions