CVE-2025-71341: Picklescan Remote Code Execution Vulnerability
Summary
CVE-2025-71341: Picklescan has a missing detection when calling built-in python profile.Profile.runctx. Affects picklescan versions < 0.0.29. Fixed in 0.0.29. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Picklescan is a Python library designed to analyze and detect malicious pickle files, commonly used in machine learning frameworks like PyTorch. It aims to enhance security by identifying potentially harmful code embedded within serialized Python objects. However, a recent vulnerability has been discovered that allows attackers to bypass Picklescan's detection mechanisms, posing a significant risk to users relying on this tool for safe model deployment.
Vulnerability Detail
The vulnerability arises from the use of the built-in Python function profile.Profile.runctx within the reduce method of a crafted payload. When a user checks a pickle file for safety using Picklescan, the library fails to detect the dangerous function call. Consequently, if the user proceeds to load the malicious pickle file using pickle.load(), it can lead to remote code execution, allowing attackers to execute arbitrary commands on the victim's system. This vulnerability affects any organization or individual using Picklescan to secure their PyTorch models, enabling supply chain attacks through the distribution of infected pickle files.
How To Fix
Latest published version: 1.0.5 as of 22 Oct 2026
pip install --upgrade "picklescan==1.0.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.29
This is the first release that contains the fix.
pip install --upgrade "picklescan==0.0.29"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually inspect pickle files before loading them, avoiding the use of Picklescan for safety checks until the package is updated. Additionally, consider using alternative serialization formats that do not pose the same risks as pickle.
Conclusion
The discovery of the CVE-2025-71341 vulnerability in Picklescan highlights the importance of vigilance when handling serialized data in Python. Users are strongly encouraged to update to the latest version of the package to mitigate risks associated with remote code execution. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for open-source vulnerabilities.
See every vulnerability recorded for picklescan →
FAQ
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability allows attackers to execute arbitrary code on the victim's system, leading to potential data breaches, unauthorized access, and supply chain attacks.
Yes, you can manually inspect pickle files and avoid using Picklescan for safety checks until the package is updated.
If immediate updates are not possible, consider using alternative serialization methods or libraries that do not have this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for picklescan.
