CVE-2025-71352: picklescan Detection Bypass via trace.Trace.runctx Gadget

Technical summary

CVE-2025-71352 describes an incomplete gadget detection flaw in picklescan's security scanning logic. The vulnerability exists because picklescan fails to recognize trace.Trace.runctx as a dangerous function when invoked through pickle's reduce protocol. The reduce method is a standard pickle mechanism that allows arbitrary callables to be serialized and executed during deserialization. An attacker can craft a pickle payload that leverages trace.Trace.runctx to achieve arbitrary code execution (ACE). This bypasses picklescan's static analysis, which typically maintains a denylist or signature-based detection of known dangerous gadgets. The vulnerability is classified under CWE-693 (Protection Mechanism Failure), reflecting the failure of a security control to properly validate untrusted input.

Business impact

Organizations using picklescan to validate untrusted pickle files face a direct risk of arbitrary code execution. This is particularly critical in data pipelines, machine learning workflows, or microservices that deserialize pickled objects from external sources. A successful exploit allows attackers to execute commands with the privileges of the application process, potentially leading to data theft, lateral movement, system compromise, or service disruption. The false sense of security provided by picklescan—when it fails to detect the trace.Trace.runctx gadget—amplifies the risk by encouraging trust in a compromised validation layer.

Affected systems

Any system running picklescan versions before 0.0.29 is vulnerable. This includes development environments, staging systems, and production deployments where picklescan is used as a gatekeeper for pickle deserialization. The vulnerability affects all platforms where Python and picklescan are installed, as the attack vector is platform-agnostic. Applications that process pickled data from untrusted sources—such as data uploaded by users, received from partner systems, or retrieved from shared storage—face the highest risk.

Exploitability

The vulnerability is readily exploitable. An attacker requires only the ability to create and deliver a malicious pickle file to a target system that uses picklescan for validation. The attack vector is network-based with low complexity: no authentication is required, and user interaction is limited to the passive act of loading a pickle file (which may occur automatically in many workflows). The CVSS score of 8.1 reflects the high confidentiality and integrity impact, coupled with the ease of exploitation. No special tools or deep system knowledge are required—attackers can craft payloads using standard Python pickle utilities and the trace.Trace.runctx function.

Remediation

Immediately upgrade picklescan to version 0.0.29 or later. This version incorporates detection logic for the trace.Trace.runctx gadget and closes the bypass. Organizations should verify the upgrade across all systems where picklescan is deployed. Additionally, consider implementing defense-in-depth measures: run pickle deserialization in isolated containers or sandboxes, apply principle of least privilege to processes that handle pickled data, and monitor for unexpected child processes or system calls originating from pickle loading operations.

Patch guidance

Upgrade picklescan to version 0.0.29 or later via pip: `pip install --upgrade picklescan>=0.0.29`. Verify the installed version with `pip show picklescan`. Test the patched version in a non-production environment first to ensure compatibility with existing workflows. Review any custom pickle handling code to confirm it benefits from the updated gadget detection. For organizations with strict change management processes, plan the upgrade during a maintenance window and validate that legitimate pickle files still deserialize correctly post-patch.

Detection guidance

Monitor for unusual child process spawning or command execution originating from Python processes that handle pickle deserialization. Check application logs for pickle.load() calls or exceptions related to untrusted data. Perform code review to identify all locations where pickle.load() or pickle.loads() is invoked, particularly with data from external sources. Use static analysis tools to scan for pickle usage patterns and validate that picklescan is present and up-to-date in the dependency tree. Network-based detection is limited but may flag suspicious outbound connections immediately following pickle deserialization events.

Why prioritize this

This vulnerability should be prioritized as HIGH due to the combination of high exploitability (network-based, low complexity, no authentication required), significant impact (arbitrary code execution with confidentiality and integrity compromise), and the false confidence it induces in users who rely on picklescan as a security control. The fix is straightforward and non-breaking, making remediation low-effort relative to the risk. Organizations should treat this as an urgent security update, particularly if picklescan is used in customer-facing or data-processing pipelines.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects: (1) Network Attack Vector—the malicious pickle can be delivered remotely; (2) Low Attack Complexity—no special conditions or user interaction beyond loading a file; (3) No Privilege Requirement—the attacker needs no prior access; (4) Limited User Interaction—passive deserialization is sufficient; (5) Unchanged Scope—impact is limited to the application; (6) High Confidentiality Impact—attackers can read sensitive data; (7) High Integrity Impact—attackers can modify or delete data; (8) No Availability Impact—the gadget focuses on code execution rather than denial of service. The score appropriately captures the severity of a bypass in a security tool.

Frequently asked questions