CVE-2025-71366: picklescan Gadget Chain Detection Bypass (Torch)

Technical summary

CVE-2025-71366 is an unsafe deserialization weakness (CWE-502) in picklescan's detection logic. The vulnerability stems from incomplete coverage of gadget chains—picklescan fails to identify torch.utils.bottleneck.__main__.run_cprofile as a dangerous callable. When a pickle file is deserialized by Python's pickle module, this function can be invoked without restriction, bypassing picklescan's intended safety perimeter. The attack vector is network-based; an attacker delivers a malicious pickle over any channel (email attachment, web download, API response) and relies on the victim to deserialize it using picklescan or Python's pickle module directly. No authentication is required from the attacker's perspective.

Business impact

Organizations using picklescan to safely handle untrusted pickle files face compromised trust in their validation layer. This is especially critical for teams processing machine learning models, data science workflows, or serialized Python objects from external sources. A successful exploit can lead to data theft, lateral movement within networks, deployment of backdoors, or supply-chain contamination if pickled objects are part of a distribution pipeline. The impact is heightened in automated environments where pickle deserialization happens without human review.

Affected systems

picklescan versions 0.0.27 and earlier are vulnerable. The library is used by Python developers and data science teams to pre-screen pickle files before loading them. Systems relying on picklescan as a primary defense mechanism against malicious serialized objects are at risk. torch (PyTorch) is not inherently vulnerable; it is the target gadget that picklescan's scanner failed to recognize. Any environment deserializing untrusted pickle data with picklescan versions before 0.0.28 is affected.

Exploitability

Exploitability is moderate to high. An attacker must craft a malicious pickle file—a non-trivial task requiring knowledge of Python serialization and the specific gadget chain—but tools and techniques for pickle exploitation are well-established in the security community. The attack requires user interaction (opening or loading the file), which is a constraint but not a significant barrier given social engineering tactics. Once delivered, exploitation is reliable: the pickle deserializes without warning, the gadget fires, and code runs. No special software versions or complex conditions are needed beyond picklescan 0.0.27 or earlier.

Remediation

Upgrade picklescan to version 0.0.28 or later immediately. This patch extends the scanner's detection rules to include the torch.utils.bottleneck.__main__.run_cprofile gadget chain and likely hardens detection of related callables. Organizations should verify the upgrade in a test environment before production rollout. As a complementary measure, restrict pickle deserialization to trusted sources only, isolate pickle processing in sandboxed environments, and consider using safer serialization formats (JSON, protobuf, msgpack) where feasible.

Patch guidance

Patch guidance: Upgrade picklescan to version 0.0.28 or later. Review your dependency management (pip, poetry, conda, etc.) to ensure the update is applied across all development, testing, and production environments. For teams using picklescan as a transitive dependency, verify that the parent package does not pin an older version. Test pickle files that previously passed validation to confirm they still load correctly with the patched version. If you maintain a corpus of pickle files for regression testing, run them against the patched scanner to ensure no legitimate workflows are broken.

Detection guidance

Detection and monitoring: Search your codebase and logs for imports of picklescan and verify all instances use version 0.0.28+. Monitor for deserialization of pickle files from untrusted sources; log file origins and validate against known-good hashes. If you cannot patch immediately, implement additional controls: disable automatic pickle loading, require manual approval for pickle operations, run pickle deserialization in isolated containers, or switch to safer formats. Intrusion detection signatures should flag unusual subprocess spawning or code execution following pickle loads from external sources.

Why prioritize this

This vulnerability merits urgent priority because picklescan is explicitly designed to prevent arbitrary code execution during pickle deserialization. Its failure to detect a known gadget chain directly undermines trust in a critical safety mechanism. The attack is remotely deliverable, requires only user interaction (not complex setup), and grants full code execution. Organizations using picklescan as part of a defense-in-depth strategy for untrusted serialized objects should patch within days, not weeks.

Risk score, explained

CVE-2025-71366 carries a CVSS 3.1 score of 8.1 (HIGH) reflecting: network-accessible attack vector, low complexity (standard pickle gadget), no special privileges required, user interaction (loading the file), and high impact on confidentiality and integrity. The score does not account for the specific context of picklescan's role as a safety validator; in practice, the risk may be higher for organizations relying solely on picklescan for defense against untrusted pickle sources.

Frequently asked questions