Executive brief
picklescan is a security tool used to scan Python pickle files and machine learning models for malicious code. A flaw in the tool allows specially crafted files to bypass its security checks by using a specific Python profiling function. If a user trusts the tool's clean scan result and opens the malicious file, an attacker could gain full control over the user's system.
Technical details
A deserialization vulnerability exists in picklescan due to an incomplete blocklist of dangerous functions. Specifically, the tool fails to identify the 'profile.Profile.run' function when it is invoked within a pickle's '__reduce__' method. An attacker can exploit this by crafting a malicious pickle file (often disguised as a PyTorch model) that bypasses detection. When a victim subsequently loads the file using 'pickle.load()', the embedded payload executes arbitrary system commands. This issue is addressed in version 0.0.29.
Affected products
- picklescan picklescan < 0.0.29
Timeline
- 2025-08-26: advisory: GHSA-x696-vm39-cp64 published
- 2026-06-30: disclosed: CVE-2025-71374 published to NVD