CVE-2025-71373: picklescan Operator.methodcaller Bypass – Detection Evasion in Python Pickle Validation

Technical summary

CVE-2025-71373 is a detection evasion vulnerability in picklescan's pickle inspection logic. The vulnerability stems from incomplete enumeration of dangerous callable objects within pickle bytecode. Specifically, operator.methodcaller—a function that dynamically invokes methods on objects—is not flagged as a security risk by picklescan's analysis engine. An attacker can construct a pickle stream that uses operator.methodcaller to instantiate and invoke arbitrary callables, resulting in code execution when pickle.loads() deserializes the payload. This bypasses picklescan's static analysis intended to prevent exactly such attacks. The issue affects all versions before 0.0.33.

Business impact

Organizations that rely on picklescan as a gating mechanism to validate untrusted pickle data face a critical control failure. Any system accepting pickled Python objects from external sources—including data processing pipelines, machine learning model serving, distributed caching layers, or inter-service communication—becomes vulnerable to remote code execution. The impact is particularly severe because the application's security posture appears sound (picklescan is in place) while the protection is silently bypassed. Compromise may lead to data theft, lateral movement, service disruption, or supply chain attacks if the affected application handles sensitive workflows.

Affected systems

All systems running picklescan versions prior to 0.0.33 are vulnerable. This includes applications that: (1) accept pickle data from untrusted or partially-trusted sources and validate it with picklescan before deserialization; (2) use picklescan in CI/CD pipelines or threat-detection workflows; (3) rely on picklescan as a primary defense against malicious pickle payloads. The vulnerability does not affect systems that do not use picklescan or those that have upgraded to 0.0.33 or later. Python pickle deserialization vulnerabilities are widespread in data science, model deployment, and legacy system integration contexts.

Exploitability

This vulnerability is highly exploitable. The attack requires no special privileges or authentication—a remote attacker simply crafts a malicious pickle file using operator.methodcaller and sends it to a vulnerable application. The attack is user-interaction dependent (the application must load the pickle), but this is a normal operation in many legitimate workflows, making the user-interaction barrier low in practical scenarios. No complex setup or race conditions are required. Proof-of-concept payloads are straightforward to construct for anyone familiar with Python pickle bytecode. The CVSS score of 8.1 (HIGH) reflects the combination of network accessibility, ease of exploitation, and severe confidentiality and integrity impact.

Remediation

Upgrade picklescan to version 0.0.33 or later immediately. This patch adds operator.methodcaller to the list of dangerous callables detected during pickle inspection. For applications unable to upgrade immediately, implement a defense-in-depth strategy: (1) avoid accepting pickle data from untrusted sources entirely—favor JSON, Protocol Buffers, or other safer serialization formats; (2) if pickle is unavoidable, deserialize in isolated, sandboxed environments with minimal privileges; (3) monitor pickle deserialization events for anomalies; (4) consider network-level controls to restrict pickle data ingress. Verify the upgrade with the vendor advisory to confirm the fix scope.

Patch guidance

Upgrade picklescan to version 0.0.33 or later. Verify the patch release notes to confirm that operator.methodcaller detection is included. Apply the upgrade to all environments—development, testing, and production—since the vulnerability affects runtime validation, not just build-time analysis. Test the upgraded picklescan against your existing pickle payloads to ensure backward compatibility with legitimate data. If you maintain custom pickle inspection logic alongside picklescan, audit it for similar gaps in dangerous callable detection.

Detection guidance

Monitor for pickle deserialization operations in your environment, particularly those preceded by picklescan validation. If picklescan is running an old version, assume any pickle data processed through it may contain undetected malicious payloads. Review logs for unexpected process execution, file writes, or network connections following pickle deserialization. Implement application-level logging to capture the origin, size, and content hash of all pickled data processed. Use Python AST analysis or bytecode inspection tools to audit existing pickles in data lakes or caches for operator.methodcaller usage patterns. Alert on any mismatch between picklescan's reported

Why prioritize this

This vulnerability is a control evasion flaw with immediate practical impact. picklescan is explicitly chosen by security teams as a safeguard against pickle deserialization attacks; a bypass in that control represents a fundamental breakdown of trust. The ease of exploitation combined with the high likelihood that picklescan deployments process untrusted data makes this a priority-one issue. Organizations using picklescan should consider an upgrade as urgent as a patched system vulnerability, not deferred maintenance.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects: Network-accessible attack vector (AV:N), low attack complexity requiring only pickle construction (AC:L), no privileges needed (PR:N), low user-interaction friction in typical pickle workflows (UI:R), confidentiality and integrity impacts (C:H, I:H), and no availability impact. The score appropriately penalizes the silent nature of this bypass—the system appears protected when it is not. The lack of KEV listing does not diminish urgency; this is a detection flaw in a security tool, making proactive patching the primary defense.

Frequently asked questions