CVE-2025-71325: picklescan detection bypass in STACK_GLOBAL opcode parsing

CVE-2025-71325 · Severity: critical · CVSS 9.8 · Published 2026-06-17

picklescan is a security tool used to scan Python pickle files and AI models for malicious code. A flaw in how the tool parses specific data structures allows attackers to craft malicious files that crash the scanner or bypass its security checks entirely. This could allow dangerous code to be uploaded to platforms like Hugging Face or executed on local systems without being detected by the scanner.

Technologies: picklescan (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2025-71325 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-71325 being exploited in the wild.
How severe is CVE-2025-71325?
Critical severity, with a CVSS score of 9.8, published 17 June 2026.
Which products and versions are affected?
Protect AI Modelscan All versions prior to fix; picklescan (PyPI) < 0.0.27, ECOSYSTEM:introduced=0,fixed=0.0.27.
Is there a fix for CVE-2025-71325?
Yes. picklescan (PyPI): upgrade to 0.0.27 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-71325 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-71325?
Check whether you run Protect AI Modelscan or picklescan (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • picklescan (PyPI): upgrade to 0.0.27 or later
    pip install "picklescan>=0.0.27"

Technical details

A parsing logic error exists in the `_list_globals` function of picklescan (and modelscan) when handling the `STACK_GLOBAL` opcode. The scanner fails to track arguments in the correct range (specifically ignoring arguments at position zero), which causes it to find an unexpected number of values. An attacker can craft a malicious pickle file that triggers an unhandled exception during this parsing process, causing the scanner to fail and allowing the malicious payload to bypass security inspection. This vulnerability affects both local installations and integrated services like Hugging Face's online scanners. The issue is resolved in version 0.0.27.

Affected products

  • picklescan picklescan < 0.0.27
  • modelscan modelscan All versions prior to fix

Identifiers

  • CVE-2025-71325
  • GHSA-9gvj-pp9x-gcfr
  • PYSEC-2026-1788

Timeline

  • 2025-08-10: advisory: GitHub Security Advisory published
  • 2026-06-17: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.