{"id":"CVE-2025-71348","title":"picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methods","summary":"picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methods. Attackers can craft pickle files embedding arbitrary code that evades detection but execut…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","cwe":["CWE-502"],"vendor":"mmaitre314","product":"picklescan","affected":["picklescan < 0.0.28"],"patched":["picklescan 0.0.28"],"published":"2026-06-21","updated":"2026-10-12","sourceUpdated":"2026-10-12T22:10:00.247","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-71348","references":[{"url":"https://github.com/mmaitre314/picklescan/security/advisories/GHSA-vv6j-3g6g-2pvj","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-torch-utils-config-module-load-config-bypass","label":"disclosure@vulncheck.com"},{"url":"https://github.com/mmaitre314/picklescan/security/advisories/GHSA-vv6j-3g6g-2pvj","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"epss":0.00554,"epssPercentile":0.4605,"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-06-22T19:05:34.765825Z"},"ingestedAt":"2026-09-14T04:30:23.179Z","slug":"CVE-2025-71348","body":"## Overview\n\npicklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methods. Attackers can craft pickle files embedding arbitrary code that evades detection but executes during pickle.load, enabling remote code execution in supply chain attacks.\n\n## Affected\n\n- `picklescan < 0.0.28`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `picklescan 0.0.28`","depth":"midnight","depthScore":57,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":230939,"id":"CVE-2025-71348","ts":1793233312087,"field":"exploit_available","old":"false","new":"true"},{"seq":230935,"id":"CVE-2025-71348","ts":1793231788464,"field":"exploit_available","old":"true","new":"false"},{"seq":230930,"id":"CVE-2025-71348","ts":1793229654156,"field":"exploit_available","old":"false","new":"true"},{"seq":230926,"id":"CVE-2025-71348","ts":1793228183510,"field":"exploit_available","old":"true","new":"false"},{"seq":230922,"id":"CVE-2025-71348","ts":1793225993285,"field":"exploit_available","old":"false","new":"true"},{"seq":230918,"id":"CVE-2025-71348","ts":1793224580379,"field":"exploit_available","old":"true","new":"false"},{"seq":230913,"id":"CVE-2025-71348","ts":1793222329895,"field":"exploit_available","old":"false","new":"true"},{"seq":230909,"id":"CVE-2025-71348","ts":1793220977499,"field":"exploit_available","old":"true","new":"false"},{"seq":230905,"id":"CVE-2025-71348","ts":1793218669657,"field":"exploit_available","old":"false","new":"true"},{"seq":230901,"id":"CVE-2025-71348","ts":1793217371200,"field":"exploit_available","old":"true","new":"false"},{"seq":230897,"id":"CVE-2025-71348","ts":1793215275142,"field":"exploit_available","old":"false","new":"true"},{"seq":230886,"id":"CVE-2025-71348","ts":1793215013137,"field":"exploit_available","old":"true","new":"false"},{"seq":230874,"id":"CVE-2025-71348","ts":1793214188499,"field":"exploit_available","old":"false","new":"true"},{"seq":230871,"id":"CVE-2025-71348","ts":1793213759141,"field":"exploit_available","old":"true","new":"false"},{"seq":230759,"id":"CVE-2025-71348","ts":1793211346327,"field":"exploit_available","old":"false","new":"true"},{"seq":230756,"id":"CVE-2025-71348","ts":1793210146649,"field":"exploit_available","old":"true","new":"false"},{"seq":230734,"id":"CVE-2025-71348","ts":1793207684358,"field":"exploit_available","old":"false","new":"true"},{"seq":230731,"id":"CVE-2025-71348","ts":1793206542568,"field":"exploit_available","old":"true","new":"false"},{"seq":230697,"id":"CVE-2025-71348","ts":1793204030521,"field":"exploit_available","old":"false","new":"true"},{"seq":230694,"id":"CVE-2025-71348","ts":1793202938945,"field":"exploit_available","old":"true","new":"false"},{"seq":230686,"id":"CVE-2025-71348","ts":1793200388937,"field":"exploit_available","old":"false","new":"true"},{"seq":230683,"id":"CVE-2025-71348","ts":1793199335823,"field":"exploit_available","old":"true","new":"false"},{"seq":230605,"id":"CVE-2025-71348","ts":1793196738488,"field":"exploit_available","old":"false","new":"true"},{"seq":230602,"id":"CVE-2025-71348","ts":1793195732141,"field":"exploit_available","old":"true","new":"false"},{"seq":230597,"id":"CVE-2025-71348","ts":1793193083500,"field":"exploit_available","old":"false","new":"true"},{"seq":230594,"id":"CVE-2025-71348","ts":1793192128544,"field":"exploit_available","old":"true","new":"false"},{"seq":230591,"id":"CVE-2025-71348","ts":1793189434973,"field":"exploit_available","old":"false","new":"true"},{"seq":230588,"id":"CVE-2025-71348","ts":1793188524969,"field":"exploit_available","old":"true","new":"false"},{"seq":230585,"id":"CVE-2025-71348","ts":1793185780283,"field":"exploit_available","old":"false","new":"true"},{"seq":230582,"id":"CVE-2025-71348","ts":1793184921006,"field":"exploit_available","old":"true","new":"false"},{"seq":230579,"id":"CVE-2025-71348","ts":1793182129517,"field":"exploit_available","old":"false","new":"true"},{"seq":230576,"id":"CVE-2025-71348","ts":1793181317110,"field":"exploit_available","old":"true","new":"false"},{"seq":230573,"id":"CVE-2025-71348","ts":1793178482380,"field":"exploit_available","old":"false","new":"true"},{"seq":230570,"id":"CVE-2025-71348","ts":1793177713819,"field":"exploit_available","old":"true","new":"false"},{"seq":230567,"id":"CVE-2025-71348","ts":1793174835045,"field":"exploit_available","old":"false","new":"true"},{"seq":230564,"id":"CVE-2025-71348","ts":1793174110525,"field":"exploit_available","old":"true","new":"false"},{"seq":230561,"id":"CVE-2025-71348","ts":1793171187010,"field":"exploit_available","old":"false","new":"true"},{"seq":230558,"id":"CVE-2025-71348","ts":1793170507611,"field":"exploit_available","old":"true","new":"false"},{"seq":230555,"id":"CVE-2025-71348","ts":1793167538971,"field":"exploit_available","old":"false","new":"true"},{"seq":230552,"id":"CVE-2025-71348","ts":1793166900455,"field":"exploit_available","old":"true","new":"false"},{"seq":230549,"id":"CVE-2025-71348","ts":1793163893055,"field":"exploit_available","old":"false","new":"true"},{"seq":230546,"id":"CVE-2025-71348","ts":1793163297331,"field":"exploit_available","old":"true","new":"false"},{"seq":230541,"id":"CVE-2025-71348","ts":1793160226381,"field":"exploit_available","old":"false","new":"true"},{"seq":230538,"id":"CVE-2025-71348","ts":1793159693512,"field":"exploit_available","old":"true","new":"false"},{"seq":230526,"id":"CVE-2025-71348","ts":1793156577533,"field":"exploit_available","old":"false","new":"true"},{"seq":230522,"id":"CVE-2025-71348","ts":1793156090637,"field":"exploit_available","old":"true","new":"false"},{"seq":230509,"id":"CVE-2025-71348","ts":1793152927815,"field":"exploit_available","old":"false","new":"true"},{"seq":230506,"id":"CVE-2025-71348","ts":1793152482718,"field":"exploit_available","old":"true","new":"false"},{"seq":230503,"id":"CVE-2025-71348","ts":1793149284185,"field":"exploit_available","old":"false","new":"true"},{"seq":230500,"id":"CVE-2025-71348","ts":1793148878813,"field":"exploit_available","old":"true","new":"false"}]}