CVE-2025-71370: Picklescan Remote Code Execution Vulnerability
Summary
CVE-2025-71370: Picklescan missing detection when calling pytorch function torch.jit.unsupported_tensor_ops.execWrapper. Affects picklescan versions < 0.0.28. Fixed in 0.0.28. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Picklescan is a Python library designed to analyze and detect malicious pickle files, particularly in the context of machine learning models using PyTorch. It aims to enhance security by identifying potentially harmful code embedded within serialized Python objects. However, a significant vulnerability exists that allows attackers to bypass its detection mechanisms, leading to severe security risks.
Vulnerability Detail
The vulnerability arises from the use of the PyTorch function torch.jit.unsupported_tensor_ops.execWrapper, which can execute remote pickle files. An attacker can craft a malicious payload that, when processed by a victim's application using Picklescan for safety checks, remains undetected. Upon loading the malicious pickle file with pickle.load(), the embedded code executes, potentially leading to remote code execution. This poses a severe risk, especially for organizations relying on Picklescan for security, as it allows attackers to distribute infected pickle files across machine learning models, APIs, or saved Python objects.
How To Fix
Latest published version: 1.0.5 as of 22 Oct 2026
pip install --upgrade "picklescan==1.0.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.28
This is the first release that contains the fix.
pip install --upgrade "picklescan==0.0.28"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the torch.jit.unsupported_tensor_ops.execWrapper function in your code until the package is updated. Additionally, consider implementing additional security checks or using alternative methods for loading pickle files.
Conclusion
In summary, the vulnerability identified as CVE-2025-71370 in the Picklescan package poses a significant risk due to its ability to allow remote code execution through undetected malicious pickle files. It is essential to update to the patched version 0.0.28 or later to mitigate this risk effectively.
See every vulnerability recorded for picklescan →
FAQ
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The potential impacts include remote code execution, which can lead to unauthorized access, data breaches, and compromised systems.
Yes, avoid using the vulnerable function and implement additional security measures for loading pickle files.
If immediate updates are not possible, ensure that you do not load untrusted pickle files and consider using alternative serialization methods.
References
Related vulnerabilities
Recent vulnerabilities recorded for picklescan.
