Picklescan Remote Code Execution via Undetected ShapeEnv Eval

Executive Summary

CVE-2025-71356 is a vulnerability in the picklescan library versions before 0.0.28 that fails to detect malicious use of the PyTorch function torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression within pickle files.

Attackers can craft pickle files embedding this function call in a way that bypasses picklescan's safety checks. When a victim loads such a pickle file using Python's pickle.load(), the embedded malicious code executes remotely.

This vulnerability enables remote code execution through deserialization of untrusted data, affecting users relying on picklescan to detect harmful pickle files in PyTorch models.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to remote code execution on your system if you load a maliciously crafted pickle file that exploits the flaw.

It poses a significant risk especially if you use picklescan to verify PyTorch model files or other pickle-based data, as attackers can embed harmful code that executes when the file is loaded.

Such an attack can be used in supply chain compromises, spreading infected files across machine learning models, APIs, or saved Python objects, potentially leading to unauthorized control or data breaches.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves malicious pickle files that use the function torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression to execute remote code when loaded. Detection involves analyzing pickle files for calls to this specific function within the reduce method.

Since picklescan versions before 0.0.28 fail to detect this, you should ensure you are using picklescan 0.0.28 or later to scan pickle files for malicious content.

A practical detection approach is to run picklescan on suspicious pickle files with a command like:

• picklescan path/to/suspicious_file.pkl

If you do not have picklescan or want to manually inspect, you can use Python commands to load pickle files in a controlled environment and check for suspicious reduce calls, but this requires advanced knowledge and is risky.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to update picklescan to version 0.0.28 or later, where this vulnerability has been patched.

Avoid loading pickle files from untrusted or unauthenticated sources, as the vulnerability allows remote code execution through malicious pickle files.

Implement strict validation and scanning of all pickle files before loading them in your environment.

Consider using alternative serialization formats that are safer than pickle if possible.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows attackers to execute arbitrary remote code by embedding malicious payloads in pickle files that are not detected by picklescan before version 0.0.28.

Such unauthorized code execution can lead to data breaches, unauthorized access, or manipulation of sensitive data, which may impact compliance with data protection regulations like GDPR and HIPAA.

Organizations relying on picklescan for security in their machine learning pipelines or data processing may face increased risk of supply chain attacks, potentially exposing personal or protected health information.

Failure to mitigate this vulnerability by updating picklescan could result in non-compliance with security requirements mandated by these standards.

Useful 0 Not Useful 0