CVE-2025-71363: picklescan Bypass Allows Code Execution via cProfile.run

Technical summary

CVE-2025-71363 exploits an incomplete validation routine in picklescan's inspection logic. The vulnerability stems from a gap in how picklescan analyzes reduce methods within pickled objects. Specifically, cProfile.run calls—which can invoke arbitrary Python code—are not properly detected during the scanning phase. An attacker can construct a pickle with a reduce method that calls cProfile.run with a malicious payload. Upon deserialization, the cProfile module executes the embedded code, bypassing picklescan's safety checks. This represents a fundamental bypass of unsafe deserialization protections, classified under CWE-502 (Deserialization of Untrusted Data).

Business impact

Organizations relying on picklescan to safely process untrusted pickle data face direct code execution risk. Pickle is commonly used in Python serialization workflows—machine learning pipelines, data caches, inter-process communication, and legacy systems all depend on it. If a business uses picklescan as part of its defense against malicious pickles (for example, from user uploads or external feeds), an attacker can weaponize this bypass to achieve arbitrary code execution with the privileges of the Python process. This could lead to data theft, lateral movement, or supply-chain compromise if pickles are shared across services.

Affected systems

Any deployment using picklescan versions prior to 0.0.30 is affected. The vulnerability is introduced by a detection gap, so the risk applies universally to all installations of the vulnerable versions regardless of operating system or Python version. Organizations should verify which versions of picklescan they have deployed, especially in data ingestion, model serving, or batch processing environments where untrusted pickle files might be deserialized.

Exploitability

The attack requires user interaction (a victim must deserialize the crafted pickle file) but is otherwise straightforward to execute. An attacker needs only to craft a valid pickle file with a cProfile.run payload and deliver it to a target. No special privileges, authentication, or system configuration is needed. The attack surface is wide for any system that processes pickles from external or semi-trusted sources. The CVSS score of 8.1 (HIGH) reflects the high impact (confidentiality and integrity compromise) and ease of exploitation, tempered by the requirement for user action to deserialize the file.

Remediation

Upgrade picklescan to version 0.0.30 or later, which includes fixes for cProfile.run detection. Organizations should also conduct an inventory of pickle sources and deserialization points in their codebase. Beyond patching, consider adopting defense-in-depth practices: restrict pickle usage to trusted, signed sources; use alternative serialization formats (JSON, Protocol Buffers) where possible; run pickle deserialization in sandboxed environments; and apply principle of least privilege to processes that deserialize untrusted data.

Patch guidance

Update picklescan via your package manager (pip install --upgrade picklescan) to a version at or above 0.0.30. Verify the update is applied by checking the installed version (pip show picklescan). If picklescan is vendored or pinned in your project dependencies, update your lock files and redeploy. Test any custom pickle handling code after the upgrade to ensure compatibility. Note that upgrading picklescan alone does not retroactively sanitize any malicious pickles already in your system—audit pickle storage and caches for suspicious files.

Detection guidance

Monitor for unexpected deserialization operations on untrusted pickle files, particularly any involving cProfile module invocations. Log pickle file sources, sizes, and deserializer versions. In machine learning and data pipeline environments, audit models and cached data loaded from external sources. Check application logs for cProfile.run calls in contexts where they should not occur. If you suspect a malicious pickle has been processed, assume code execution occurred and investigate for lateral movement, data exfiltration, or persistence mechanisms. Implement file integrity monitoring on pickle repositories to detect tampering.

Why prioritize this

This vulnerability should be prioritized HIGH because it represents a direct bypass of a security control (picklescan itself) that organizations may be relying on to mitigate pickle deserialization attacks. The exploitability is straightforward once a malicious pickle reaches a system, and the impact is full code execution. Any organization using picklescan for security purposes must patch immediately; those not yet on 0.0.30 face active risk from relatively simple attacks. The requirement for user interaction (deserialization) slightly lowers urgency compared to network-based exploits, but the ease of payload delivery through normal data channels keeps priority high.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects: (1) Network-accessible attack vector—pickles can be delivered remotely via web upload, API, or file transfer; (2) Low attack complexity—no special conditions or system state needed; (3) No privilege requirement—any user can deserialize; (4) User interaction required—a developer or application must explicitly deserialize the pickle; (5) High confidentiality and integrity impact—arbitrary code execution compromises both; (6) No availability impact—code execution does not inherently crash systems. The score appropriately balances the severity of code execution against the practical requirement that an application must be configured to deserialize the malicious pickle.

Frequently asked questions