CVE-2025-71375: picklescan Detection Bypass via _operator.methodcaller – HIGH Severity

Technical summary

picklescan is a static analysis tool for identifying dangerous operations in serialized Python pickle objects before deserialization. The vulnerability stems from incomplete opcode and function coverage: the scanner does not detect _operator.methodcaller, a built-in callable that can be weaponized to invoke arbitrary methods on objects during unpickling. An attacker can construct a pickle payload using methodcaller to execute code in a way that evades picklescan's detection logic while remaining fully functional when processed by pickle.load(). This is classified under CWE-502 (Deserialization of Untrusted Data), the root class for pickle exploit families.

Business impact

Organizations using picklescan as part of their data validation pipeline face a critical degradation of security posture. If pickle data from untrusted sources (APIs, user uploads, message queues) is scanned by the vulnerable version and then loaded, attackers can achieve remote code execution despite the security check. This is especially problematic in data science, ML training pipelines, and inter-service communication where pickle is still common. The false confidence created by a failed security scan may delay incident detection and response.

Affected systems

picklescan versions before 0.0.34 are affected. The vulnerability does not affect specific downstream products listed by the vendor, but rather impacts any system that integrates picklescan as a security control for pickle validation. This includes custom applications, data processing workflows, and security scanning infrastructure that depend on picklescan to vet untrusted pickle objects.

Exploitability

Exploitation requires network-accessible attack surface (CVSS AV:N) and no special privileges (PR:N), but does require user interaction such as opening a crafted file or triggering deserialization of a malicious payload (UI:R). The attack complexity is low (AC:L), meaning weaponization is straightforward once the methodcaller bypass is understood. No CISA KEV listing has been assigned, indicating limited evidence of in-the-wild active exploitation at publication, though the bypass is deterministic and reliable.

Remediation

Immediately upgrade picklescan to version 0.0.34 or later, which adds detection for _operator.methodcaller and closes this bypass. After patching, re-scan any pickle files previously validated with the vulnerable version, particularly those from external or lower-trust sources. Review access logs and pickle deserialization records to identify any loads that occurred between initial validation and patch deployment. For defense-in-depth, consider supplementing picklescan with additional controls such as running pickle.load() in sandboxed environments or using alternative serialization formats (JSON, Protocol Buffers) where feasible.

Patch guidance

Upgrade picklescan to version 0.0.34 or later. Verify the patched version is in use by checking the installed package version (pip show picklescan) and reviewing release notes to confirm methodcaller detection was added. If picklescan is vendored or bundled into a larger application, coordinate with the application maintainer to confirm they have released an updated build. Test the patched version against known malicious pickle samples and your organization's benign pickle test suite to ensure no regression in scanning performance or false positives.

Detection guidance

Monitor for pickle deserialization operations, especially from untrusted sources (network endpoints, uploaded files, queues). If using picklescan, track scan results and correlate with actual deserialization events to identify cases where scans passed but code execution occurred (indicating a bypass). Look for unusual process spawning, file writes, or network connections following pickle operations. Review version control and package management logs to identify systems still running picklescan < 0.0.34. Implement logging at the pickle.load() call site to record source, size, and timestamp of deserialized objects.

Why prioritize this

This vulnerability merits immediate prioritization because it is a detection bypass—it specifically breaks a defensive control that security teams rely on to keep pickle safe. The high CVSS score (8.1) reflects remote exploitability with user interaction and high impact on confidentiality and integrity. Although not yet in CISA KEV, the vulnerability is straightforward to exploit and could be weaponized rapidly in targeted campaigns against data pipelines. Any organization using picklescan in production should treat this as a critical patching requirement.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects: (1) Network accessibility (AV:N) allowing remote exploitation; (2) Low attack complexity (AC:L) due to straightforward methodcaller usage; (3) No authentication required (PR:N); (4) User interaction needed (UI:R) to trigger pickle loading; (5) High impact on confidentiality and integrity (C:H, I:H) through arbitrary code execution; (6) Availability unaffected (A:N). The score does not account for the compounding risk of tool bypass—the fact that picklescan is supposed to prevent exactly this scenario elevates real-world risk beyond the base score.

Frequently asked questions