Picklescan is missing detection when calling built-in Python cProfile.runctx (CVE-2025-71378)
### Summary Using cProfile.runctx function, which is a built-in python library function to execute remote pickle file. ### Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to cProfile.runctx function in reduce method Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution. ### PoC ``` import cProfile class EvilCProfileRunctx: def __reduce__(self): # cProfile.runctx(cmd, globals, locals) -> exec(cmd, ...) return cProfile.runctx, ("__import__('os').system('whoami')", None, None) ``` ### Impact Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models. What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded. Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects. ### Corresponding https://github.com/FredericDT https://github.com/Qhaoduoyu
AI Analysis
Technical Summary
Picklescan is a library used to detect malicious pickle files. This vulnerability (CVE-2025-71378) arises because Picklescan does not detect when the built-in Python function cProfile.runctx is called within a pickle file's reduce method. An attacker can craft a pickle payload that uses cProfile.runctx to execute arbitrary commands, which Picklescan fails to flag as dangerous. When a victim loads such a pickle file after Picklescan's check, remote code execution occurs. This affects Picklescan versions before 0.0.30.
Potential Impact
Attackers can embed malicious code in pickle files that evade detection by Picklescan and execute upon loading. This can lead to remote code execution on the victim's system. Organizations or individuals using Picklescan to verify pickle files, especially in machine learning workflows involving PyTorch models, are at risk. The vulnerability enables supply chain attacks by distributing infected pickle files through ML models, APIs, or saved Python objects.
Mitigation Recommendations
A patch is available for Picklescan to detect this malicious usage of cProfile.runctx. Users should upgrade to version 0.0.30 or later to mitigate this vulnerability. Until patched, avoid loading pickle files solely based on Picklescan's validation and consider additional security controls.
Picklescan is missing detection when calling built-in Python cProfile.runctx (CVE-2025-71378)
Description
### Summary Using cProfile.runctx function, which is a built-in python library function to execute remote pickle file. ### Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to cProfile.runctx function in reduce method Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution. ### PoC ``` import cProfile class EvilCProfileRunctx: def __reduce__(self): # cProfile.runctx(cmd, globals, locals) -> exec(cmd, ...) return cProfile.runctx, ("__import__('os').system('whoami')", None, None) ``` ### Impact Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models. What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded. Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects. ### Corresponding https://github.com/FredericDT https://github.com/Qhaoduoyu
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Picklescan is a library used to detect malicious pickle files. This vulnerability (CVE-2025-71378) arises because Picklescan does not detect when the built-in Python function cProfile.runctx is called within a pickle file's reduce method. An attacker can craft a pickle payload that uses cProfile.runctx to execute arbitrary commands, which Picklescan fails to flag as dangerous. When a victim loads such a pickle file after Picklescan's check, remote code execution occurs. This affects Picklescan versions before 0.0.30.
Potential Impact
Attackers can embed malicious code in pickle files that evade detection by Picklescan and execute upon loading. This can lead to remote code execution on the victim's system. Organizations or individuals using Picklescan to verify pickle files, especially in machine learning workflows involving PyTorch models, are at risk. The vulnerability enables supply chain attacks by distributing infected pickle files through ML models, APIs, or saved Python objects.
Mitigation Recommendations
A patch is available for Picklescan to detect this malicious usage of cProfile.runctx. Users should upgrade to version 0.0.30 or later to mitigate this vulnerability. Until patched, avoid loading pickle files solely based on Picklescan's validation and consider additional security controls.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-9w88-8rmg-7g2p
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2025-71378"]
- Ecosystems
- ["PyPI"]
- Database Specific Severity
- MODERATE
Threat ID: 6aa47eb655bf5e2cf5857966
Added to database: 09/11/2026, 22:20:38 UTC
Last enriched: 09/11/2026, 22:49:32 UTC
Last updated: 09/12/2026, 02:01:23 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.