CVE-2025-71353: Picklescan Detection Bypass Enables Arbitrary Code Execution

Technical summary

CVE-2025-71353 is an unsafe deserialization detection evasion in picklescan that allows attackers to bypass security controls through a reduce method exploit leveraging torch._dynamo.guards.GuardBuilder.get. Pickle's reduce protocol enables custom object reconstruction; attackers craft payloads that exploit this mechanism in a way picklescan's static analysis fails to identify. The vulnerability stems from incomplete pattern matching or insufficient coverage of guard-builder-based gadget chains. This creates a dangerous false sense of security: applications using picklescan to validate untrusted pickle data may inadvertently load and execute attacker-controlled code.

Business impact

Organizations using picklescan to validate pickle files before deserialization face a critical trust boundary failure. If an application ingests pickle data from untrusted sources—including uploaded model files, cached data, or remote repositories—an attacker can bypass picklescan validation and achieve arbitrary code execution. This undermines the security assumption that picklescan provides, potentially affecting machine learning pipelines, data processing workflows, and any system that deserializes pickle objects. The reputational and operational impact extends beyond the immediate host to any downstream systems the compromised process interacts with.

Affected systems

Picklescan versions prior to 0.0.28 are vulnerable. Any application or pipeline that uses picklescan to validate pickle files before loading them is at risk if that validation is treated as a security boundary. This includes machine learning frameworks integrating picklescan, data science platforms, and custom applications that deserialize pickle data. PyTorch users are particularly relevant given the exploit chain involves torch._dynamo.guards, though the vulnerability is in picklescan's detection logic rather than PyTorch itself.

Exploitability

The vulnerability requires user interaction (loading a pickle file) but is otherwise straightforward to exploit. An attacker crafts a malicious pickle file using the torch._dynamo.guards.GuardBuilder.get gadget and delivers it to a target—via upload, model sharing, repository hosting, or supply chain compromise. The file passes picklescan inspection because the tool does not recognize this particular evasion technique. Exploitation is reliable once the victim loads the file; no additional user actions or system misconfigurations are required. The network attack vector and lack of authentication requirements elevate severity.

Remediation

Immediately upgrade picklescan to version 0.0.28 or later, which patches the detection gap. Review any pickle files that were validated using vulnerable versions—they may contain undetected malicious payloads. In parallel, implement defense-in-depth: run picklescan-validated pickle loading in isolated environments or containers with minimal privileges, restrict network access, use code signing or integrity verification for trusted pickle sources, and monitor for unexpected process spawning or network activity during deserialization. Do not rely solely on picklescan for security; treat it as one layer in a broader validation strategy.

Patch guidance

Upgrade picklescan to version 0.0.28 or later. This patch enhances detection logic to recognize and block reduce methods exploiting torch._dynamo.guards.GuardBuilder.get. After patching, re-scan any pickle files processed during the vulnerability window to ensure they do not contain malicious payloads. Coordinate the patch rollout with dependent applications and workflows to avoid disruption; consider lab testing with real pickle files from your pipeline before production deployment. Verify the upgrade in your environment by confirming picklescan version and testing against known-malicious samples if available.

Detection guidance

Monitor for pickle deserialization operations, particularly from untrusted or user-supplied sources. Use file integrity monitoring or hashing to detect unauthorized modifications to pickle caches or model repositories. During incident investigation, examine pickle files for reduce method calls involving torch._dynamo.guards.GuardBuilder.get or similar guard-based constructs using pickle analysis tools (e.g., pickletools.dis). Check process logs and system calls for unexpected child process spawning, network connections, or file writes immediately after pickle loading. If picklescan was used as a validation gate, flag all pickle files it processed prior to patching as requiring re-evaluation.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score (8.1) driven by high confidentiality and integrity impact and easy exploitability. The core threat—a security tool bypass that enables arbitrary code execution—is particularly dangerous because it inverts trust assumptions: systems relying on picklescan for protection become more vulnerable if they lower their guard after validation. The network attack surface and lack of user prerequisites (beyond standard interaction of loading a file) make it practical to exploit at scale. Machine learning and data-heavy organizations should prioritize this patch urgently.

Risk score, explained

CVSS 3.1 score of 8.1 (HIGH) reflects: (1) network-accessible attack vector—pickle files can be delivered remotely; (2) low complexity, no privileges required; (3) user interaction limited to loading a file (a normal operation); (4) high impact on confidentiality and integrity (arbitrary code execution); (5) no impact on availability. The score appropriately captures the severity of arbitrary code execution enabled by a detection bypass in a widely-used validation tool.

Frequently asked questions