Executive brief
picklescan is a security tool used to scan Python pickle files and machine learning models (like PyTorch) for malicious code. A vulnerability in versions before 0.0.29 allows specially crafted malicious files to bypass detection by using a specific Python internal function. If a user relies on the tool's "safe" verdict and proceeds to open the file, an attacker could gain full control over the user's system.
Technical details
A deserialization vulnerability exists in picklescan due to an incomplete blocklist of dangerous functions. Specifically, the tool fails to identify the use of 'code.InteractiveInterpreter.runcode' within a pickle's __reduce__ method. An attacker can craft a malicious pickle payload that picklescan flags as safe; however, when the victim subsequently loads the file using 'pickle.load()', the payload executes arbitrary Python code. This bypasses the primary security control intended for scanning untrusted machine learning models and serialized Python objects. The issue is resolved in version 0.0.29.
Affected products
- picklescan picklescan < 0.0.29
Timeline
- 2025-08-26: advisory: Initial GitHub security advisory published
- 2026-06-30: disclosed: CVE-2025-71371 published and enriched by VulnCheck