# CVE-2025-71325: picklescan detection bypass in STACK_GLOBAL opcode parsing

Source: https://junglewise.ai/threats/cve-2025-71325-picklescan-detection-bypass-in-stack-global-opcode-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-17. Updated: 2026-06-20  
License: CC BY 4.0 with a link back

CVE-2025-71325 · Severity: critical · CVSS 9.8 · Published 2026-06-17

picklescan is a security tool used to scan Python pickle files and AI models for malicious code. A flaw in how the tool parses specific data structures allows attackers to craft malicious files that crash the scanner or bypass its security checks entirely. This could allow dangerous code to be uploaded to platforms like Hugging Face or executed on local systems without being detected by the scanner.

Technologies: [picklescan (PyPI)](https://junglewise.ai/threats/technologies/picklescan). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2025-71325 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-71325 being exploited in the wild.

**How severe is CVE-2025-71325?** Critical severity, with a CVSS score of 9.8, published 17 June 2026.

**Which products and versions are affected?** Protect AI Modelscan All versions prior to fix; picklescan (PyPI) < 0.0.27, ECOSYSTEM:introduced=0,fixed=0.0.27.

**Is there a fix for CVE-2025-71325?** Yes. picklescan (PyPI): upgrade to 0.0.27 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-71325 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-71325?** Check whether you run Protect AI Modelscan or picklescan (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- picklescan (PyPI): upgrade to 0.0.27 or later

  ```sh
  pip install "picklescan>=0.0.27"
  ```


## Technical details

A parsing logic error exists in the `_list_globals` function of picklescan (and modelscan) when handling the `STACK_GLOBAL` opcode. The scanner fails to track arguments in the correct range (specifically ignoring arguments at position zero), which causes it to find an unexpected number of values. An attacker can craft a malicious pickle file that triggers an unhandled exception during this parsing process, causing the scanner to fail and allowing the malicious payload to bypass security inspection. This vulnerability affects both local installations and integrated services like Hugging Face's online scanners. The issue is resolved in version 0.0.27.

## Affected products

- picklescan picklescan < 0.0.27
- modelscan modelscan All versions prior to fix

## Identifiers

- CVE-2025-71325
- GHSA-9gvj-pp9x-gcfr
- PYSEC-2026-1788

## Timeline

- 2025-08-10: advisory: GitHub Security Advisory published
- 2026-06-17: disclosed: NVD publication date

## References

- [https://github.com/mmaitre314/picklescan/commit/2a8383cfeb4158567f9770d86597300c9e508d0f](https://github.com/mmaitre314/picklescan/commit/2a8383cfeb4158567f9770d86597300c9e508d0f)
- [https://github.com/mmaitre314/picklescan/security/advisories/GHSA-9gvj-pp9x-gcfr](https://github.com/mmaitre314/picklescan/security/advisories/GHSA-9gvj-pp9x-gcfr)
- [https://www.vulncheck.com/advisories/picklescan-detection-bypass-via-stack-global-opcode-parsing-logic-flaw](https://www.vulncheck.com/advisories/picklescan-detection-bypass-via-stack-global-opcode-parsing-logic-flaw)

## Related threats

- [picklescan detection bypass via _operator.methodcaller](https://junglewise.ai/threats/cve-2025-71375-picklescan-detection-bypass-via-operator-methodcaller)
- [picklescan security bypass via operator.methodcaller](https://junglewise.ai/threats/cve-2025-71373-picklescan-security-bypass-via-operator-methodcaller)
- [Picklescan detection bypass via numpy getlincoef gadget](https://junglewise.ai/threats/cve-2025-71372-picklescan-detection-bypass-via-numpy-getlincoef-gadget)
- [picklescan safety check bypass via PyTorch decoder basichandlers](https://junglewise.ai/threats/cve-2025-71369-picklescan-safety-check-bypass-via-pytorch-decoder-basichandlers)
- [picklescan security bypass via _operator.attrgetter function call](https://junglewise.ai/threats/cve-2025-71367-picklescan-security-bypass-via-operator-attrgetter-function-call)