CVE-2025-71378: picklescan Bypass via cProfile.runctx Detection Gap

Technical summary

CVE-2025-71378 exploits a detection bypass in picklescan's analysis logic. The vulnerability stems from incomplete handling of cProfile.runctx function calls within pickle reduce methods. Pickle's reduce protocol allows serialized objects to specify custom deserialization behavior. By embedding cProfile.runctx calls in reduce methods, attackers craft pickle files that pass picklescan's safety checks but execute arbitrary code when deserialized via pickle.load(). This is classified as CWE-502 (Deserialization of Untrusted Data), a well-known attack vector in Python ecosystems. The CVSS 3.1 score of 8.1 reflects high impact (confidentiality and integrity compromise) with network accessibility and low complexity.

Business impact

Organizations relying on picklescan to safely validate pickle files before processing them face a significant trust gap. If pickle files are ingested from untrusted sources—common in data science workflows, distributed systems, or model serving architectures—attackers can bypass the security control entirely. The impact extends to confidentiality (data exfiltration) and integrity (data manipulation), though availability isn't directly impacted. This is particularly concerning in ML/data science environments where pickle is the standard serialization format and automated pipelines may load files with minimal human oversight.

Affected systems

The vulnerability affects picklescan versions prior to 0.0.30. Any system or application using an affected version of picklescan to validate pickle files before deserialization is vulnerable. This includes data science platforms, machine learning pipelines, model repositories, and any custom tools that depend on picklescan for security validation.

Exploitability

Exploitability is moderately straightforward. An attacker must craft a malicious pickle file using cProfile.runctx in a reduce method—a technique requiring pickle expertise but not particularly sophisticated. The pickle file must then reach a target that (1) runs picklescan to validate it and (2) subsequently loads it via pickle.load(). User interaction is required in the sense that a person or process must initiate the pickle loading, but no social engineering or complex weaponization is necessary. Public exploit code is not widely documented, but the technique is within reach of competent adversaries.

Remediation

Upgrade picklescan to version 0.0.30 or later immediately. This version patches the detection logic to properly recognize and block cProfile.runctx function calls in reduce methods. Organizations should verify the version of picklescan in their environment, including in transitive dependencies. After patching, re-validate any existing pickle files that were previously scanned with the vulnerable version.

Patch guidance

Update picklescan to 0.0.30 or later. If using package management (pip), run 'pip install --upgrade picklescan'. Verify the update with 'pip show picklescan' to confirm the version is 0.0.30 or higher. For containerized or locked environments, update your requirements.txt, pyproject.toml, or equivalent dependency file and rebuild. Test the updated version against your existing pickle file processing to ensure compatibility. No breaking changes are expected with this patch.

Detection guidance

Monitor for pickle.load() or unpickle operations in your codebase and logs. If using picklescan, verify logs show it's running version 0.0.30+. If you have samples of pickle files validated with earlier versions of picklescan, consider re-scanning them with the patched version. Behavioral detection should focus on unexpected subprocess execution or system calls originating from Python pickle deserialization—look for cProfile-related execution or unusual child processes spawned during data pipeline runs.

Why prioritize this

This vulnerability merits immediate attention because picklescan is a security tool; its compromise directly undermines trust in the validation layer. The high CVSS score (8.1) reflects realistic attack impact. While KEV status is not currently assigned, the detection bypass nature and pickle's ubiquity in Python ecosystems means this will likely be actively exploited in targeted campaigns. Organizations with data pipelines processing external pickle files face elevated risk.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) is driven by: (1) Network accessibility (AV:N)—malicious pickle files can arrive remotely; (2) Low attack complexity (AC:L)—no special conditions required beyond crafting a valid pickle; (3) No privilege escalation needed (PR:N); (4) High confidentiality and integrity impact (C:H/I:H)—arbitrary code execution compromises both. Availability is not impacted (A:N), preventing a critical rating. The user interaction requirement (UI:R) prevents a higher score, but does not eliminate risk in automated environments.

Frequently asked questions