CVE-2025-71359: picklescan 0.0.29 RCE via lib2to3 Gadget Chain Bypass

Technical summary

CVE-2025-71359 exploits a gadget chain detection gap in picklescan's scanning logic. The vulnerability stems from the library's failure to recognize lib2to3.pgen2.grammar.Grammar.loads as a dangerous reduce target. This method can be abused during pickle deserialization to instantiate and execute arbitrary code. The attack relies on pickle's well-known unsafe deserialization model, where reduce methods are called during unpickling. Because picklescan does not flag this specific path, applications relying on picklescan as their sole anti-pickle-exploit defense will incorrectly approve malicious files, leading to remote code execution when pickle.load() is invoked.

Business impact

Organizations using picklescan to validate untrusted pickle files face a critical control bypass. This is particularly severe in data pipelines, ML workflows, or inter-service communication that accept pickle-serialized data from external or semi-trusted sources. An attacker can deliver a weaponized pickle file that passes picklescan validation but executes arbitrary code on the host, potentially compromising confidentiality and integrity. Development teams relying on picklescan as their primary defense against pickle exploitation are at heightened risk until they upgrade.

Affected systems

picklescan versions prior to 0.0.29 are vulnerable. Any application using an older version of picklescan to validate pickle files before deserialization is affected. This includes data science workflows, Python-based services that deserialize pickled objects, and tools that consume pickled ML models or cached data structures. The vulnerability does not affect Python's pickle module itself, only the detection capability of picklescan.

Exploitability

Exploitation requires an attacker to craft a malicious pickle file and trick or directly cause an application to pass it through picklescan validation before deserialization. The attack vector is network-based if the application accepts pickle data remotely. User interaction is required in the CVSS vector, suggesting the victim must either manually deserialize a suspicious file or the application must be explicitly configured to load untrusted pickles. Once a crafted file is accepted, code execution is reliable and full.

Remediation

Upgrade picklescan to version 0.0.29 or later immediately. After patching, validate that your application's pickle validation logic is correctly configured. As a defense-in-depth measure, consider restricting pickle deserialization to trusted sources only, using alternative serialization formats like JSON where possible, or sandboxing pickle deserialization in restricted environments. Review any pickled data that may have been processed by the vulnerable scanner.

Patch guidance

Update picklescan to version 0.0.29 or newer via your package manager (pip install --upgrade picklescan or equivalent). Verify the update is complete by checking the installed version (pip show picklescan). No configuration changes are required post-upgrade, but existing validation rules should be re-tested against known pickle gadgets to confirm improved detection. Consult the picklescan project repository or release notes for any breaking changes or new filtering options in the patched version.

Detection guidance

Monitor for attempts to load pickle files from untrusted sources or unusual deserialization patterns in your application logs. Search for pickle.load(), pickle.loads(), and picklescan usage in your codebase to identify all points where validation occurs. Audit any pickle files that were processed by vulnerable picklescan versions prior to the discovery date (July 2026). If available, use YARA rules or behavioral detection to identify execution of Python code spawned immediately after pickle deserialization. In a SOC context, correlate pickle file uploads or transfers with unexpected process execution on servers running vulnerable picklescan versions.

Why prioritize this

This vulnerability merits immediate attention because it directly undermines a control that organizations implement to prevent pickle-based RCE. A CVSS score of 8.1 (HIGH) reflects the high confidentiality and integrity impact, though availability is unaffected. The bypass nature—where picklescan gives false confidence—makes it especially dangerous. Organizations should deprioritize only if they do not deserialize untrusted pickles or have already migrated away from pickle as a data format.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects: (1) Network attack vector (AV:N)—exploitation requires network delivery of a pickle file; (2) Low attack complexity (AC:L)—no special conditions are needed once the malicious file is crafted; (3) No privilege requirement (PR:N)—any user can submit a pickle file; (4) User interaction required (UI:R)—the application or user must process the file; (5) Unchanged scope (S:U)—the impact is limited to the application using picklescan; (6) High confidentiality and integrity impact (C:H/I:H)—remote code execution allows full system compromise; (7) No availability impact (A:N)—the exploit does not typically cause denial of service. The score does not include KEV status because the vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog.

Frequently asked questions