CVE-2025-71369: picklescan RCE via Undetected Torch Utility Bypass

Technical summary

CVE-2025-71369 is an improper input validation vulnerability in picklescan's deserialization safety analysis. The vulnerability exists in picklescan versions prior to 0.0.28. Attackers exploit a gap in the tool's inspection logic by embedding malicious reduce methods that reference torch.utils.data.datapipes.utils.decoder.basichandlers. Reduce methods are a serialization mechanism in Python pickle that allow custom deserialization behavior; picklescan's detection patterns fail to flag this specific PyTorch-based construct as dangerous. Upon deserialization by a target application, the arbitrary code embedded in these methods executes without restriction, leading to remote code execution (RCE). This is classified under CWE-502 (Deserialization of Untrusted Data), a well-known attack surface in Python environments.

Business impact

Organizations using picklescan as a trust boundary for untrusted pickle data face a critical gap in their defense. If picklescan is deployed in a pipeline to pre-validate pickle files from external sources—such as model weights, cached datasets, or user uploads—an attacker can bypass that validation and execute arbitrary code on the server or processing system. This could lead to data exfiltration, lateral movement, malware installation, or denial of service. The risk is elevated in machine learning and data engineering workflows where pickle deserialization is common.

Affected systems

picklescan versions before 0.0.28 are vulnerable. Any deployment of picklescan used to vet untrusted pickle files is at risk, particularly in data science platforms, machine learning model repositories, and data pipeline systems that accept external pickle inputs. PyTorch users who rely on picklescan to validate pickle files containing torch.utils.data.datapipes components are especially exposed. Systems that do not use picklescan or that apply additional layers of validation (e.g., sandboxing) may be unaffected.

Exploitability

Exploitation is straightforward from an attacker's perspective. An attacker with the ability to create or modify pickle files can embed malicious code using the undetected torch utility pattern and distribute the file via any channel—email, a model registry, a public dataset, or a compromised repository. The attack requires user interaction only in the sense that someone must deserialize the file; no authentication is required, and the network attack surface is broad (AV:N). Once the pickle is deserialized, code execution is immediate. The CVSS score of 8.1 reflects high confidentiality and integrity impact with no availability component, appropriate for this attack profile.

Remediation

Upgrade picklescan to version 0.0.28 or later. This release includes improved detection patterns that correctly identify malicious reduce methods using torch.utils.data.datapipes.utils.decoder.basichandlers and similar evasion techniques. Organizations should prioritize this update for any system that uses picklescan as a validation gate for untrusted pickle files. Beyond patching, consider supplementary defenses: restrict pickle deserialization to sandboxed environments, run deserialization in isolated processes with minimal privileges, avoid deserializing pickle files from untrusted sources without additional verification, and monitor for unusual unpickling operations.

Patch guidance

Update picklescan to 0.0.28 or later. Verify the update against the official picklescan repository and release notes to confirm the patch addresses CWE-502 detection gaps. If your environment uses picklescan as a library in a larger data pipeline, test the update in a staging environment to ensure no breaking changes to validation rules or output formats. Document the upgrade in your vulnerability remediation tracking system and mark pre-0.0.28 instances as no longer approved for security-critical roles.

Detection guidance

Monitor for deployments of picklescan versions prior to 0.0.28 using software inventory and dependency scanning tools (e.g., pip show, Software Composition Analysis). Check your project requirements.txt, pyproject.toml, or Pipenv lock files for picklescan pinned to an old version. In runtime environments, log all pickle deserialization operations and flag cases where picklescan is used but the version cannot be confirmed as 0.0.28 or later. If possible, enable audit logging on any system that processes untrusted pickle files to detect attempted evasion or suspicious deserialization patterns.

Why prioritize this

This vulnerability should be prioritized if your organization uses picklescan as a trust boundary for untrusted pickle data. The CVSS score of 8.1 and the ease of exploitation (network-accessible, no authentication) make this a high-priority fix. Machine learning teams, data engineering platforms, and model repositories that accept external pickle files should patch immediately. For organizations that do not rely on picklescan or do not deserialize untrusted pickles, the risk is lower but should still be assessed.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) is driven by the network attack vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), and user interaction only in the weak sense of 'someone must deserialize the file' (UI:R). The vulnerability grants high confidentiality and integrity impact (C:H, I:H) as arbitrary code execution is possible, but does not directly cause availability loss (A:N). The score does not account for the fact that this vulnerability defeats a security tool's purpose, which amplifies real-world risk beyond the numerical rating.

Frequently asked questions