CVE-2025-71344: picklescan detection bypass via ensurepip._run_pip

Executive brief

Picklescan is a security tool used to detect malicious code hidden within Python pickle files, which are commonly used to store Machine Learning models. A vulnerability was found where the tool fails to detect a specific dangerous function, allowing attackers to hide malicious code that executes automatically when a user loads a scanned file. This could lead to unauthorized access or data theft on systems that trust Picklescan to verify the safety of third-party AI models.

Technical details

Picklescan before version 0.0.30 is vulnerable to a detection bypass. The tool's scanning logic does not account for the 'ensurepip._run_pip' function, which can be leveraged within a pickle's '__reduce__' method to execute arbitrary commands. An attacker can craft a malicious pickle file that passes Picklescan's safety checks but triggers remote code execution (RCE) when processed by 'pickle.load()'. This is particularly relevant for supply chain security in Machine Learning workflows using PyTorch models. The issue is fixed in version 0.0.30.

Affected products

• mmaitre314 picklescan < 0.0.30

Timeline

• 2025-08-26: advisory: GHSA-xp4f-hrf8-rxw7 published
• 2025-08-26: patched: Version 0.0.30 released

References

• https://api.github.com/users/FredericDT
• https://github.com/FredericDT
• https://api.github.com/users/FredericDT/gists%7B/gist_id%7D
• https://api.github.com/users/FredericDT/repos
• https://avatars.githubusercontent.com/u/16513314?v=4
• https://api.github.com/users/FredericDT/events%7B/privacy%7D