CVE-2025-71371: picklescan Detection Bypass via code.InteractiveInterpreter.runcode

Technical summary

CVE-2025-71371 exploits a detection gap in picklescan's static analysis of pickle opcodes. The vulnerability leverages the code.InteractiveInterpreter.runcode construct within pickle reduce methods—a serialization pattern that picklescan fails to properly identify as dangerous. Pickle's reduce protocol allows objects to specify custom deserialization logic; by embedding runcode calls in this context, attackers can instantiate arbitrary Python code execution paths that bypass picklescan's inspection heuristics. The issue is classified as CWE-502 (Deserialization of Untrusted Data), a well-known vector for arbitrary code execution in Python environments.

Business impact

Organizations using picklescan as a primary defense against malicious pickle files face a critical trust boundary failure. Any system that accepts pickled data from external sources—including data pipelines, ML model repositories, configuration files, or inter-service RPC calls—becomes vulnerable if picklescan is the sole validation layer. An attacker can deliver a weaponized pickle file that appears safe to security scanning but executes attacker-controlled code upon loading, potentially leading to data exfiltration, lateral movement, supply chain compromise, or system takeover depending on the privileges of the Python process consuming the pickle.

Affected systems

Any deployment running picklescan versions prior to 0.0.29 is affected. The vulnerability applies regardless of operating system. Impact depends on where picklescan is deployed: development environments, CI/CD pipelines, data processing workflows, or production services that deserialize untrusted pickle data. Python environments relying on picklescan as a gating mechanism for model loading, configuration ingestion, or data serialization are at highest risk.

Exploitability

Exploitability is straightforward. An attacker needs only to craft a pickle payload using code.InteractiveInterpreter.runcode in a reduce method and deliver it to a target that validates it with vulnerable picklescan before deserialization. The CVSS vector reflects network attack feasibility (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), and a user interaction requirement (UI:R)—meaning the victim must take an action to load the pickle file, such as downloading a model or processing a serialized data object. No special exploit infrastructure is needed; the attack is inherent to the pickle format itself.

Remediation

Upgrade picklescan to version 0.0.29 or later. After patching, audit any pickle files that were validated by older versions and consider re-validating them with the patched version. Additionally, evaluate whether picklescan is sufficient as a standalone defense: defense-in-depth strategies should include sandboxing pickle deserialization, running Python processes with minimal privileges, and limiting pickle usage to trusted internal sources where possible. Consider alternative serialization formats (JSON, MessagePack, Protocol Buffers) for new systems to reduce reliance on pickle deserialization altogether.

Patch guidance

Update picklescan to version 0.0.29 or later. Verify the update through your package manager (pip, conda, etc.) and confirm the installed version matches the fixed release. Test the patched version in a non-production environment first to ensure compatibility with your workflow. Once deployed, the updated picklescan should correctly identify and reject pickle payloads using code.InteractiveInterpreter.runcode in reduce methods.

Detection guidance

Identify all systems running picklescan and their versions using dependency scanning tools or package audits. Look for pickle deserialization operations in your codebase and verify they are protected by picklescan validation. If picklescan is used, audit logs or monitoring can detect unusual code execution patterns following pickle loading. For threat hunting: search for pickle files originating from external sources, unusual reduce methods in pickle opcodes, or references to code.InteractiveInterpreter.runcode in serialized Python data. Monitor Python interpreter logs for unexpected code execution from untrusted input sources.

Why prioritize this

This vulnerability merits immediate attention because it directly bypasses a security tool that organizations trust to prevent arbitrary code execution. The CVSS score of 8.1 reflects high impact (confidentiality and integrity), network accessibility, and low attack complexity. While it requires user interaction (loading a file), the interaction is passive from the user's perspective—they may simply open a model, load a config, or process a data file without realizing they're deserializing malicious code. Any organization using picklescan for validation should treat this as a critical update, particularly if pickle files cross trust boundaries.

Risk score, explained

CVSS 3.1 score of 8.1 (HIGH) is justified by: (1) High confidentiality impact—code execution allows data exfiltration; (2) High integrity impact—attacker can modify system state and data; (3) Network attack vector—malicious pickles can be delivered remotely; (4) Low attack complexity—no special conditions needed; (5) No privilege requirement; (6) User interaction required—victim must load the pickle, though this may be an automated process. Availability is not directly impacted (hence no A:H), though secondary effects could occur. The score appropriately reflects that this is a critical remote code execution flaw in a security-sensitive component.

Frequently asked questions