CVE-2025-71357: Picklescan Evasion via idlelib.pyshell.ModifiedInterpreter

Technical summary

CVE-2025-71357 is a deserialization detection evasion vulnerability in picklescan that results from incomplete validation of pickle gadget chains. Specifically, the library does not block or flag the use of idlelib.pyshell.ModifiedInterpreter.runcommand as a reduce method target. Pickle's reduce protocol allows objects to specify custom unpickling behavior; attackers exploit this by constructing reduce chains that invoke ModifiedInterpreter.runcommand, which can execute shell commands. This gadget chain bypasses picklescan's validation logic, enabling remote code execution when untrusted pickle data is deserialized. The vulnerability affects all versions prior to 0.0.30.

Business impact

Organizations relying on picklescan to validate untrusted pickle files before deserialization are exposed to remote code execution attacks. This is particularly critical in data processing pipelines, machine learning model loading workflows, and any environment where pickled objects from external sources are consumed. A successful exploit allows attackers to execute arbitrary commands with the privileges of the process, potentially leading to full system compromise, data exfiltration, or lateral movement within a network.

Affected systems

Picklescan versions before 0.0.30 are vulnerable. Any system or application that uses picklescan as a security layer to validate pickle files before deserialization is at risk. This includes data science workflows, MLOps platforms, and applications that accept serialized Python objects from untrusted sources.

Exploitability

Exploitation requires network access and user interaction—specifically, the victim must load a malicious pickle file (CVSS AV:N, UI:R). The attack has low complexity and requires no privileges (AC:L, PR:N). Once a victim loads a crafted pickle file, remote command execution occurs automatically. The barrier to exploitation is moderate: attackers must understand pickle serialization and the ModifiedInterpreter gadget, but no zero-click delivery mechanism is present in the vulnerability itself.

Remediation

Upgrade picklescan to version 0.0.30 or later, which addresses the detection bypass by adding validation for the idlelib.pyshell.ModifiedInterpreter.runcommand gadget chain. Verify the upgrade by testing with known malicious pickle samples. As a compensating control, implement strict input validation, restrict pickle deserialization to trusted sources only, and consider using alternative serialization formats (JSON, Protocol Buffers) where feasible.

Patch guidance

Apply picklescan version 0.0.30 or newer across all affected environments. Verify the upgrade does not break existing pickle validation workflows by running regression tests with your organization's typical pickle datasets. Check the picklescan project repository and release notes to confirm the fix addresses the idlelib.pyshell.ModifiedInterpreter gadget path before deploying to production.

Detection guidance

Search logs and code repositories for any pickle deserialization operations, particularly those that process untrusted input or rely on picklescan for validation. Monitor for unexpected child processes spawning from Python interpreters processing pickle data. Examine pickle files for the presence of idlelib.pyshell.ModifiedInterpreter references in reduce methods using a pickle inspector or hex editor. Implement logging around pickle.loads() and picklescan.scan() calls to capture validation bypass attempts.

Why prioritize this

This vulnerability should be prioritized because it directly undermines a security control (picklescan) designed to prevent pickle-based RCE. Organizations may have assumed they were protected from malicious pickle files by running them through picklescan, creating a false sense of security. The HIGH CVSS score (8.1) reflects the severity of unauthenticated remote code execution with user interaction. Any system actively using picklescan for validation should patch immediately.

Risk score, explained

The CVSS v3.1 score of 8.1 (HIGH) reflects: network-accessible attack vector (AV:N), low attack complexity with no special privileges required (AC:L, PR:N), high impact to confidentiality and integrity of the target system (C:H, I:H), and no availability impact (A:N). User interaction is required to load the malicious pickle (UI:R), which prevents a higher critical rating but does not materially reduce risk in pipelines where pickle loading is automated or routine.

Frequently asked questions