Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Critical severity, with a CVSS score of 9.8, published 17 June 2026.

Which products and versions are affected?

Protect AI Modelscan < 0.0.27; picklescan (PyPI) < 0.0.27.

Is there a fix for This vulnerability?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run Protect AI Modelscan or picklescan (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Picklescan detection bypass via STACK_GLOBAL opcode parsing flaw

Q: Is there a fix for This vulnerability?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is This vulnerability attacked?

It is attacked over the network, in a software library.

Q: Am I affected?

Check whether you run Protect AI Modelscan or picklescan (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: critical · CVSS 9.8 · Published 2026-06-17

Picklescan is a security tool used to scan Python pickle files and AI models for malicious code. A flaw in how the tool parses specific data structures allows attackers to craft malicious files that bypass security checks entirely. This could lead to the execution of unauthorized code on systems that rely on these scans to verify the safety of uploaded models or data.

Technologies: picklescan (PyPI). Vendors: PyPI.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Critical severity, with a CVSS score of 9.8, published 17 June 2026.
Which products and versions are affected?: Protect AI Modelscan < 0.0.27; picklescan (PyPI) < 0.0.27.
Is there a fix for This vulnerability?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run Protect AI Modelscan or picklescan (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A logic error exists in the _list_globals function of picklescan (and by extension modelscan) when processing the STACK_GLOBAL opcode. The function fails to include the zero-index position when tracking stack arguments, causing it to miscount the number of arguments present. By placing a malicious argument at position zero, an attacker can trigger an 'Unchecked Error Condition' (CWE-391) that results in an unexpected exception. This exception halts the scanning process prematurely, allowing the malicious pickle file to be treated as safe or otherwise bypass the security filter. The vulnerability is resolved in version 0.0.27.

Affected products

mmaitre314 picklescan < 0.0.27
protectai modelscan < 0.0.27

Timeline

2025-08-10: advisory: Original GHSA-9gvj-pp9x-gcfr published
2026-06-17: disclosed: CVE-2025-71325 assigned
2026-06-18: other: Duplicate advisory GHSA-5rph-q42j-36j9 withdrawn

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.