{"id":"CVE-2025-71348","aliases":["GHSA-vv6j-3g6g-2pvj","PYSEC-2026-245"],"title":"Picklescan is missing detection when calling pytorch function torch.utils._config_module.load_config","summary":"Picklescan is missing detection when calling pytorch function torch.utils._config_module.load_config","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","vendor":"picklescan","product":"picklescan","ecosystem":"pip","affected":["picklescan < 0.0.28"],"patched":["picklescan 0.0.28"],"published":"2025-08-22","updated":"2026-09-11","sourceUpdated":"2026-09-11T19:45:09.010579634Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-vv6j-3g6g-2pvj","references":[{"url":"https://github.com/mmaitre314/picklescan/security/advisories/GHSA-vv6j-3g6g-2pvj"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71348"},{"url":"https://github.com/mmaitre314/picklescan/pull/47"},{"url":"https://github.com/mmaitre314/picklescan/commit/7f994d62084fe43f1cffdef2f9bae6923344ef53"},{"url":"https://github.com/mmaitre314/picklescan"},{"url":"https://github.com/mmaitre314/picklescan/releases/tag/v0.0.28"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/picklescan/PYSEC-2026-245.yaml"},{"url":"https://www.vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-torch-utils-config-module-load-config-bypass"},{"url":"https://github.com/advisories/GHSA-vv6j-3g6g-2pvj"}],"tags":["osv","pip","ghsa"],"epss":0.00554,"epssPercentile":0.4389,"cwe":["CWE-345"],"ingestedAt":"2026-09-11T19:57:09.309Z","slug":"CVE-2025-71348","body":"## Overview\n\n### Summary\n\nUsing torch.utils._config_module.load_config function, which is a pytorch library function to execute remote pickle file.\n\n### Details\n\nThe attack payload executes in the following steps:\n\nFirst, the attacker crafts the payload by calling the torch.utils._config_module.load_config function via the __reduce__ method. Then the victim checks whether the pickle file is safe using the Picklescan library. Because the library fails to detect any dangerous functions, the victim decides to pickle.load() this malicious file, leading to remote code execution.\n\n### PoC\n\n```\nimport pickle\nfrom torch.utils._config_module import ConfigModule\n\nclass Evil:\n    def __reduce__(self):\n        return (os.system, ('whoami',))\n\nclass EvilTorchUtilsConfigModuleLoadConfig:\n    def __reduce__(self):\n        evil_payload = pickle.dumps(Evil())\n        return ConfigModule.load_config, (None, evil_payload)\n```\n\n### Impact\n\nWho is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.\nWhat is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.\nSupply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.\n\n### Corresponding\n\nhttps://github.com/FredericDT\nhttps://github.com/Qhaoduoyu\n\n## Affected packages\n\n- `picklescan < 0.0.28`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `picklescan 0.0.28`","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":211455,"id":"CVE-2025-71348","ts":1790462328788,"field":"exploit_available","old":"true","new":"false"},{"seq":211451,"id":"CVE-2025-71348","ts":1790461225236,"field":"exploit_available","old":"false","new":"true"},{"seq":211447,"id":"CVE-2025-71348","ts":1790458681299,"field":"exploit_available","old":"true","new":"false"},{"seq":211443,"id":"CVE-2025-71348","ts":1790457621967,"field":"exploit_available","old":"false","new":"true"},{"seq":211439,"id":"CVE-2025-71348","ts":1790454019125,"field":"exploit_available","old":"true","new":"false"},{"seq":211435,"id":"CVE-2025-71348","ts":1790451441163,"field":"exploit_available","old":"false","new":"true"},{"seq":211431,"id":"CVE-2025-71348","ts":1790450416255,"field":"exploit_available","old":"true","new":"false"},{"seq":211427,"id":"CVE-2025-71348","ts":1790447802337,"field":"exploit_available","old":"false","new":"true"},{"seq":211423,"id":"CVE-2025-71348","ts":1790446813189,"field":"exploit_available","old":"true","new":"false"},{"seq":211419,"id":"CVE-2025-71348","ts":1790443210223,"field":"exploit_available","old":"false","new":"true"},{"seq":211415,"id":"CVE-2025-71348","ts":1790440561367,"field":"exploit_available","old":"true","new":"false"},{"seq":211411,"id":"CVE-2025-71348","ts":1790439607196,"field":"exploit_available","old":"false","new":"true"},{"seq":211407,"id":"CVE-2025-71348","ts":1790436923054,"field":"exploit_available","old":"true","new":"false"},{"seq":211403,"id":"CVE-2025-71348","ts":1790436003862,"field":"exploit_available","old":"false","new":"true"},{"seq":211399,"id":"CVE-2025-71348","ts":1790433260184,"field":"exploit_available","old":"true","new":"false"},{"seq":211395,"id":"CVE-2025-71348","ts":1790432400189,"field":"exploit_available","old":"false","new":"true"},{"seq":211391,"id":"CVE-2025-71348","ts":1790429600674,"field":"exploit_available","old":"true","new":"false"},{"seq":211387,"id":"CVE-2025-71348","ts":1790428796915,"field":"exploit_available","old":"false","new":"true"},{"seq":211383,"id":"CVE-2025-71348","ts":1790425961227,"field":"exploit_available","old":"true","new":"false"},{"seq":211379,"id":"CVE-2025-71348","ts":1790425193739,"field":"exploit_available","old":"false","new":"true"},{"seq":211372,"id":"CVE-2025-71348","ts":1790421572426,"field":"exploit_available","old":"true","new":"false"},{"seq":211347,"id":"CVE-2025-71348","ts":1790414675917,"field":"exploit_available","old":"false","new":"true"},{"seq":211338,"id":"CVE-2025-71348","ts":1790411303649,"field":"exploit_available","old":"true","new":"false"},{"seq":211334,"id":"CVE-2025-71348","ts":1790410663569,"field":"exploit_available","old":"false","new":"true"},{"seq":211308,"id":"CVE-2025-71348","ts":1790408605645,"field":"exploit_available","old":"true","new":"false"},{"seq":211304,"id":"CVE-2025-71348","ts":1790407663727,"field":"exploit_available","old":"false","new":"true"},{"seq":211298,"id":"CVE-2025-71348","ts":1790407076742,"field":"exploit_available","old":"true","new":"false"},{"seq":211294,"id":"CVE-2025-71348","ts":1790407059568,"field":"exploit_available","old":"false","new":"true"},{"seq":211290,"id":"CVE-2025-71348","ts":1790404023314,"field":"exploit_available","old":"true","new":"false"},{"seq":211286,"id":"CVE-2025-71348","ts":1790403452519,"field":"exploit_available","old":"false","new":"true"},{"seq":211282,"id":"CVE-2025-71348","ts":1790400418798,"field":"exploit_available","old":"true","new":"false"},{"seq":211278,"id":"CVE-2025-71348","ts":1790399849460,"field":"exploit_available","old":"false","new":"true"},{"seq":211270,"id":"CVE-2025-71348","ts":1790396777806,"field":"exploit_available","old":"true","new":"false"},{"seq":211266,"id":"CVE-2025-71348","ts":1790396246185,"field":"exploit_available","old":"false","new":"true"},{"seq":211262,"id":"CVE-2025-71348","ts":1790393124327,"field":"exploit_available","old":"true","new":"false"},{"seq":211258,"id":"CVE-2025-71348","ts":1790392642847,"field":"exploit_available","old":"false","new":"true"},{"seq":211254,"id":"CVE-2025-71348","ts":1790389518924,"field":"exploit_available","old":"true","new":"false"},{"seq":211250,"id":"CVE-2025-71348","ts":1790389039771,"field":"exploit_available","old":"false","new":"true"},{"seq":211237,"id":"CVE-2025-71348","ts":1790385876486,"field":"exploit_available","old":"true","new":"false"},{"seq":211233,"id":"CVE-2025-71348","ts":1790385436465,"field":"exploit_available","old":"false","new":"true"},{"seq":211212,"id":"CVE-2025-71348","ts":1790382159425,"field":"exploit_available","old":"true","new":"false"},{"seq":211208,"id":"CVE-2025-71348","ts":1790381833029,"field":"exploit_available","old":"false","new":"true"},{"seq":211202,"id":"CVE-2025-71348","ts":1790378476621,"field":"exploit_available","old":"true","new":"false"},{"seq":211198,"id":"CVE-2025-71348","ts":1790378229849,"field":"exploit_available","old":"false","new":"true"},{"seq":211192,"id":"CVE-2025-71348","ts":1790374831336,"field":"exploit_available","old":"true","new":"false"},{"seq":211188,"id":"CVE-2025-71348","ts":1790374627202,"field":"exploit_available","old":"false","new":"true"},{"seq":211179,"id":"CVE-2025-71348","ts":1790371179956,"field":"exploit_available","old":"true","new":"false"},{"seq":211175,"id":"CVE-2025-71348","ts":1790371024179,"field":"exploit_available","old":"false","new":"true"},{"seq":211160,"id":"CVE-2025-71348","ts":1790367469218,"field":"exploit_available","old":"true","new":"false"},{"seq":211156,"id":"CVE-2025-71348","ts":1790367420634,"field":"exploit_available","old":"false","new":"true"}]}