Executive brief
picklescan is a security tool used to scan Python pickle files and machine learning models for malicious code. A vulnerability in versions prior to 0.0.28 allows specially crafted files to bypass detection by using a specific PyTorch function. If a user relies on the tool's clean report and proceeds to open the file, an attacker could execute arbitrary commands on the victim's system, potentially leading to a full system compromise or data theft.
Technical details
A deserialization vulnerability (CWE-502) exists in picklescan due to an incomplete blocklist of dangerous functions. Specifically, the tool fails to flag the 'torch.utils.collect_env.run' function when used within a pickle's __reduce__ method. An attacker can craft a malicious pickle file that executes arbitrary shell commands via this PyTorch utility. Because picklescan reports the file as safe, users are likely to proceed with pickle.load(), triggering the payload. The issue is resolved in version 0.0.28, which adds the missing function to the detection engine.
Affected products
- picklescan picklescan < 0.0.28
Timeline
- 2025-08-22: advisory: Initial GHSA advisory published
- 2026-06-30: disclosed: CVE-2025-71350 published to NVD