CVE-2025-71356: Picklescan Bypass via PyTorch ShapeEnv—Remote Code Execution in Pickle Files

Technical summary

CVE-2025-71356 exploits an unsafe deserialization vulnerability in picklescan's inspection logic. The vulnerability stems from insufficient detection coverage of torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression function calls within pickle bytecode. When a victim loads a malicious pickle file using Python's pickle module (or compatible libraries), the crafted ShapeEnv.evaluate_guards_expression invocation bypasses picklescan's scanning heuristics and executes attacker-controlled code in the context of the unpickling process. The root cause is CWE-502 (Deserialization of Untrusted Data), where the detection mechanism does not maintain a comprehensive allowlist or blocklist for all dangerous callable types.

Business impact

Organizations relying on picklescan to safely process pickle files from external or semi-trusted sources face a material compromise of that security boundary. If picklescan was deployed as a gatekeeper before loading pickles from APIs, cloud storage, or third-party data pipelines, an attacker can circumvent it entirely. The impact extends to any data science or machine learning workflow that deserializes models, datasets, or intermediate artifacts in pickle format. A successful exploit grants the attacker the same privileges as the process loading the pickle, potentially enabling data exfiltration, lateral movement, or supply chain infection if the compromised system has further downstream access.

Affected systems

Any system using picklescan versions prior to 0.0.28 is vulnerable if it processes pickle files from untrusted or partially-trusted sources. This includes data science teams using picklescan to validate model checkpoints, data ingestion pipelines that scan incoming serialized Python objects, and security teams using picklescan as part of artifact scanning workflows. PyTorch users who rely on picklescan to vet model files are particularly exposed, given the attack vector's reliance on a PyTorch-specific function. The vulnerability does not affect picklescan installations already running version 0.0.28 or later.

Exploitability

Exploitation requires two preconditions: the attacker must be able to craft and deliver a malicious pickle file to a victim, and the victim must load that file using a system running vulnerable picklescan (or no security scanning at all). The attack does not require authentication, special network conditions, or complex social engineering—a pickle file can be embedded in an email, hosted on a web server, or injected into a data pipeline. Once the malicious pickle reaches a process with deserialization permissions, code execution is immediate and reliable. The CVSS score of 8.1 reflects this combination of network accessibility, low complexity, and no privilege escalation requirement, offset only by the user interaction requirement (the victim must explicitly deserialize the pickle).

Remediation

Upgrade picklescan to version 0.0.28 or later immediately. This patched version includes enhanced detection logic that covers torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression calls and likely other previously-missed callable types. In parallel, adopt defense-in-depth practices: (1) avoid deserializing pickle files from untrusted sources when possible; (2) use safer serialization formats (JSON, Protocol Buffers, MessagePack) for data exchange; (3) enforce sandboxing or containerization around any pickle deserialization; (4) implement network segmentation to limit lateral movement if code execution occurs.

Patch guidance

Apply the upgrade to picklescan 0.0.28 or later across all systems where the tool is deployed. Prioritize systems that process externally-sourced pickle files or are exposed to multi-tenant environments. Verify the upgrade by checking the installed version (e.g., `pip show picklescan` or similar package manager command) and confirm that your deployment reflects the patched version. If picklescan is integrated into a larger CI/CD or scanning pipeline, ensure the upgrade is reflected in container images, requirements files, and dependency manifests before rolling out to production. Test the updated scanner on known-malicious pickle samples if available to confirm detection improvements.

Detection guidance

Monitor for attempted deserialization of pickle files in production environments, particularly if they originate from external sources. Look for process execution or unusual activity immediately following pickle deserialization events. If you suspect a malicious pickle was processed before the patch, review process logs, network connections, and file modifications that occurred during or shortly after the deserialization. File integrity monitoring on pickle artifacts and access logs to model storage can help identify tampering. Consider implementing a blocklist of known-malicious pickle hashes alongside picklescan to catch signatures of actively-exploited samples.

Why prioritize this

This vulnerability merits immediate attention because it directly undermines a tool that many organizations trust as a security control. The high CVSS score (8.1) reflects the severity of remote code execution combined with low barriers to exploitation. The attack surface is broad for anyone using picklescan in production, and the failure mode—silent bypassing of the scanner—means that compromised systems may not be detected until damage has occurred. Patching is straightforward and low-risk, making it a high-return security action.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) is justified by: (1) Network accessibility (AV:N) and low attack complexity (AC:L)—the attacker needs only to deliver a pickle file; (2) no privilege escalation or special conditions required (PR:N); (3) high confidentiality and integrity impact (C:H, I:H)—code execution grants access to sensitive data and system modification; (4) no availability impact (A:N) unless the attacker chooses to halt the process; (5) user interaction required (UI:R)—the victim must deserialize the pickle. The score reflects a realistic threat scenario where an attacker delivers a weaponized pickle file and a user or automated system loads it without realizing the scanner has been bypassed.

Frequently asked questions