CVE-2025-71374: picklescan Gadget Chain Bypass Allows Arbitrary Code Execution

Technical summary

CVE-2025-71374 stems from incomplete opcode validation in picklescan's pickle scanning logic. The vulnerability exploits the REDUCE opcode in combination with the profile.Profile.run callable. When pickle deserializes a reduce operation, it instantiates the specified callable with provided arguments. picklescan's detection signatures did not account for profile.Profile.run as a dangerous gadget chain, allowing it to slip through validation. An attacker can weaponize this by embedding the function reference in a crafted pickle payload that executes arbitrary Python code during deserialization—a classic unsafe deserialization vulnerability (CWE-502). The attack requires network delivery of the malicious pickle file and user interaction to trigger deserialization.

Business impact

Organizations that rely on picklescan as a gating mechanism for untrusted pickle data are exposed to remote code execution (RCE). If picklescan is deployed as a safety layer in workflows that process externally sourced pickled objects—such as machine learning model serialization, inter-service communication, or data pipelines—a bypass means malicious payloads can reach the deserialization step undetected. The impact is code execution with the privileges of the Python process, potentially leading to data theft, lateral movement, or service compromise. The effective security control has failed, leaving downstream systems vulnerable.

Affected systems

picklescan versions prior to 0.0.29 are affected. The vulnerability manifests when those versions scan pickle files that contain the profile.Profile.run gadget. Any deployment using an older picklescan release as a defensive layer faces the exposure. Downstream Python applications that deserialize pickles presumed safe by a vulnerable picklescan release are at risk.

Exploitability

Exploitability is moderate to high. The attack requires an attacker to craft a pickle file (a standardized binary format) and deliver it to a target system where it will be deserialized. User interaction is required—someone must trigger the deserialization process. However, no special privileges are needed to craft the payload, the network vector is open, and the exploitation technique (gadget chain construction) is feasible for a skilled attacker. Once delivered, code execution is reliable if picklescan fails to block it.

Remediation

Update picklescan to version 0.0.29 or later. This release includes enhanced detection logic that recognizes profile.Profile.run in reduce operations and flags it as dangerous. After updating, re-scan any historically processed pickle files or validate that your pickle ingestion pipeline is not relying on older picklescan versions. If picklescan is used as part of a defense-in-depth strategy, ensure it remains current alongside other mitigations such as avoiding pickle deserialization of untrusted data and using safer serialization formats where feasible.

Patch guidance

1. Identify all systems and applications using picklescan. 2. Check the installed version (picklescan --version or via package managers). 3. Upgrade to 0.0.29 or later using your package manager (e.g., pip install --upgrade picklescan). 4. Verify the upgrade by confirming the version. 5. Test pickle scanning on sample payloads to ensure the patched version blocks profile.Profile.run gadgets. 6. Review any CI/CD pipelines or automated scanning jobs that invoke picklescan to ensure they are using the updated binary. 7. If pickle files are cached or stored, consider re-scanning them with the patched version.

Detection guidance

Monitor for pickle deserialization errors or unexpected code execution in Python processes handling pickled data. If you are running an older picklescan, manually test it against pickle samples containing profile.Profile.run (e.g., using pickle.dumps with a reduce operation) to confirm the gap. In production, intrusion detection signatures for pickle gadget chain execution (such as unusual process spawning from Python interpreters) may catch exploitation attempts. Log all picklescan invocations and their results, flagging any files that are processed and later found to be malicious.

Why prioritize this

This is a HIGH-severity vulnerability affecting a security-critical tool. picklescan's purpose is to prevent exactly this class of attack—unsafe deserialization of untrusted pickle data. A bypass in a security scanning tool is particularly dangerous because it erodes trust in a control that defenders rely on. The CVSS score of 8.1 reflects high confidentiality and integrity impact via a low-complexity network attack with user interaction. Organizations using picklescan to gate untrusted pickle processing should prioritize the upgrade immediately. For those not using picklescan, this highlights the inherent risks of pickle deserialization and reinforces the need to avoid it or use alternative serialization formats.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) is assigned as follows: Attack Vector (Network) indicates the payload is deliverable over the network. Attack Complexity (Low) means the exploit requires standard pickle crafting techniques. Privileges Required (None) reflects that no special access is needed. User Interaction (Required) accounts for the need for someone to deserialize the pickle. Scope (Unchanged) indicates the impact is limited to the target application. Confidentiality (High) and Integrity (High) reflect code execution capability—an attacker can read sensitive data and modify system state. Availability (None) is scored as Not Applicable because denial of service is not the primary concern. The score reflects a serious breach of a security tool's intended function, justifying the HIGH severity rating.

Frequently asked questions