CVE-2025-71364: picklescan Detection Evasion Leads to RCE

Technical summary

The vulnerability stems from incomplete detection logic in picklescan's pickle analysis engine. Specifically, the tool does not identify `asyncio.unix_events._UnixSubprocessTransport._start` as a dangerous function when it appears in pickle reduce methods. Pickle's reduce protocol allows objects to be serialized by specifying a callable and arguments; when unpickled, Python invokes that callable. By embedding this built-in function in a reduce operation, attackers construct payloads that execute subprocess commands at unpickle time while evading picklescan's analysis. This is a detection evasion issue, not a Python pickle flaw—picklescan's purpose is to prevent exactly this scenario, and this version fails to do so for this particular function.

Business impact

Organizations relying on picklescan as a defensive layer against malicious pickle ingestion face reduced confidence in their pickle validation pipeline. If applications deserialize untrusted pickle data after passing it through vulnerable picklescan versions, attackers can achieve remote code execution on those systems. The impact is particularly acute in data processing pipelines, machine learning workflows, and message queues where pickle is used for object serialization. Compromised servers could lead to data exfiltration, lateral movement, supply chain compromise, or operational disruption.

Affected systems

All applications using picklescan versions prior to 0.0.30 are vulnerable. This includes any deployment where picklescan is the primary or sole validation mechanism before pickle deserialization. The impact is highest in environments that process pickle objects from potentially untrusted sources—web applications accepting serialized user input, data processing platforms consuming external datasets, or distributed systems handling inter-service communication via pickle.

Exploitability

The attack requires minimal technical skill to execute: an attacker crafts a malicious pickle file using standard Python pickle methods, ensuring the payload includes the bypassed asyncio function, and delivers it to a target application. Exploitation does require user interaction or automated processing that loads the pickle file, so direct remote exploitation of unattended systems isn't possible, but in typical workflows (file uploads, API requests, job queues), this barrier is low. The CVSS score of 8.1 reflects the network accessibility, ease of crafting the payload, and high impact (confidentiality and integrity compromise) balanced against the user interaction requirement.

Remediation

Upgrade picklescan to version 0.0.30 or later immediately. This patch version adds detection for the previously missed `asyncio.unix_events._UnixSubprocessTransport._start` function and likely hardens the detection logic more broadly. After patching, redeploy all applications and services that depend on picklescan to ensure the updated validation is in place. During the transition, consider additional mitigations: restrict pickle deserialization to internal trusted sources only, disable pickle support in favor of safer serialization formats like JSON, and implement network segmentation to limit lateral movement if code execution occurs.

Patch guidance

Upgrade picklescan to version 0.0.30 or later. Verify against the official picklescan release notes and repository to confirm the patch version number, as this intelligence is based on the vulnerability description. Update your Python package manager (pip) to pull the latest version: `pip install --upgrade picklescan>=0.0.30`. After upgrading, restart all applications and services that import picklescan to load the patched code. If your deployment uses a centralized Python environment or container images, rebuild and redeploy those artifacts to propagate the fix.

Detection guidance

Search your environment for picklescan usage and dependency declarations. Check requirements.txt, setup.py, pyproject.toml, Pipfile, or poetry.lock files for picklescan entries and extract version constraints. In running Python processes, query installed packages via `pip list | grep picklescan` or programmatically inspect `picklescan.__version__`. Monitor application logs and pickle processing workflows for anomalies or unexpected subprocess spawning, which may indicate exploitation. If you process pickle files from external sources, temporarily enforce additional validation: implement a blanket rejection of pickle formats in favor of JSON or MessagePack, or add secondary validation layers (sandboxed unpickling, code review of pickled object types) while patching.

Why prioritize this

This vulnerability merits immediate attention because it directly undermines a security control (picklescan) that organizations deploy to defend against code execution via pickle deserialization. A HIGH CVSS score combined with evasion of a detection tool creates urgency; attackers can silently bypass defenses. The flaw affects any pipeline using picklescan for validation, and the fix is straightforward and low-risk. Prioritize systems that handle external or untrusted pickle data, then broaden to all picklescan deployments.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) factors in network accessibility (attackers can deliver malicious pickle files remotely), low attack complexity (standard pickle crafting), no privilege requirements, and high impact to confidentiality and integrity (arbitrary code execution). The user interaction requirement (someone must load the pickle file) prevents a CRITICAL rating but is a realistic constraint in most pickle-processing workflows. The absence from CISA's known exploited vulnerabilities list does not lower risk; detection evasion flaws are attractive to sophisticated attackers and may be exploited before public awareness.

Frequently asked questions