CVE-2025-71340 picklescan CVE debrief

Who should care

Defenders responsible for PyTorch models and saved Python objects should assess exposure and prioritize upgrading to picklescan version 0.0.30 or later. They should also validate pickle files before loading them and monitor for suspicious pickle file activity. This includes verifying pickle file validation and sanitization, assessing exposure of PyTorch models and saved Python objects, and tracking exceptions and retesting remediated assets.

Why it matters

CVE-2025-71340 is a high-severity vulnerability in the picklescan library that can enable supply chain attacks on PyTorch models and saved Python objects. Defenders should prioritize upgrading to version 0.0.30 or later and validating pickle files before loading them.

• Verify pickle file validation and sanitization
• Assess exposure of PyTorch models and saved Python objects
• Prioritize upgrading to picklescan version 0.0.30 or later
• Monitor for suspicious pickle file activity

Technical summary

The picklescan library through version 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.ModifiedInterpreter.runcode in __reduce__ methods, allowing attackers to embed undetected code that executes arbitrary commands when the file is loaded via pickle.load(). This vulnerability enables supply chain attacks on PyTorch models and saved Python objects. The issue is fixed in version 0.0.30, and defenders should prioritize upgrading to this version or later and validating pickle files before loading them.

Defensive priority

Defenders should prioritize upgrading to picklescan version 0.0.30 or later and validating pickle files before loading them.

Recommended defensive actions

• Upgrade to picklescan version 0.0.30 or later
• Validate pickle files before loading them
• Monitor for suspicious pickle file activity
• Verify pickle file validation and sanitization
• Assess exposure of PyTorch models and saved Python objects
• Prioritize upgrading to picklescan version 0.0.30 or later
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the scope of affected versions and potential impact require further verification. The picklescan library through version 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.ModifiedInterpreter.runcode in __reduce__ methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when the file is loaded via pickle.load().

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.