Picklescan Remote Code Execution via Undetected Malicious Pickle Files

Executive Summary

CVE-2025-71345 is a vulnerability in picklescan versions before 0.0.30 that fails to detect malicious pickle files invoking the PyTorch function torch.utils.bottleneck.__main__.run_autograd_prof.

Attackers can embed malicious code in these pickle files that executes during deserialization, allowing arbitrary remote code execution.

This occurs because picklescan does not detect the use of this specific function in the pickle file, which can be exploited to run harmful code when the pickle is loaded.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to remote code execution on systems that use picklescan to verify pickle files before loading them.

Attackers can craft malicious pickle files that bypass picklescan detection and execute arbitrary code when deserialized, potentially compromising the affected system.

It poses a supply chain risk, especially for organizations or individuals relying on picklescan to check PyTorch models, APIs, or saved Python objects, as infected pickle files could be distributed and executed unknowingly.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves malicious pickle files that invoke the function torch.utils.bottleneck.__main__.run_autograd_prof, which picklescan versions before 0.0.30 fail to detect.

To detect this vulnerability, you should scan pickle files using picklescan version 0.0.30 or later, as earlier versions do not detect this malicious invocation.

A typical command to scan a pickle file would be:

• picklescan path/to/your_pickle_file.pkl

If you are using an older version of picklescan, it may not detect the malicious payload. Therefore, ensure your picklescan tool is updated before scanning.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to update picklescan to version 0.0.30 or later, which includes detection for this specific malicious pickle payload.

Additionally, avoid loading pickle files from untrusted or unauthenticated sources, especially those that may invoke PyTorch functions during deserialization.

Consider implementing strict validation and scanning of all pickle files before deserialization to prevent remote code execution.

Useful 0 Not Useful 0

Compliance Impact

CVE-2025-71345 allows remote code execution through malicious pickle files that bypass detection in picklescan versions before 0.0.30. This vulnerability poses a supply chain risk by enabling attackers to distribute infected pickle files via machine learning models, APIs, or saved Python objects.

Such unauthorized code execution can lead to unauthorized access, data breaches, or manipulation of sensitive data, which may impact compliance with data protection regulations like GDPR and HIPAA that require safeguarding personal and sensitive information.

Organizations relying on picklescan for security in their ML workflows or Python object handling should update to version 0.0.30 or later to mitigate this risk and help maintain compliance with these standards.

Useful 0 Not Useful 0