CVE-2025-71348General(mmaitre314 / picklescan)

LOWCVSS 7.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methods. Attackers can craft pickle files embedding arbitrary code that evades detection but executes during pickle.load, enabling remote code execution in supply chain attacks.

mmaitre314 CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Exploit / PoC references

Vendor / third-party advisories

https://www.vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-torch-utils-config-module-load-config-bypass

Weakness type (CWE)

CWE-502

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

picklescan

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
General: 1 classified signal
Disclosure: 1 classified signal
Peaked 1d ago at 1 mentions (2026-06-21); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

mmaitre314

Products

picklescan

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

General

150.0%

Disclosure

150.0%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-21	1	General1
2026-06-23	1	Disclosure1

Full discourse2 posts

Cyber Threat Observatory | Alan Turing Institute@TuringCyberObs90d
Disclosure
CVE-2025-71348 — picklescan Python library A deserialization vulnerability that can allow malicious pickle files to evade detection and execute arbitrary code during model loading. Full analysis: https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-06-21/TIER_2_CVE-2025-71348.md #VulnerabilityManagement #DPI #CloudSecurity
Post summary
A new deserialization vulnerability (CVE‑2025‑71348) in the picklescan Python library can allow malicious pickle files to evade detection and execute arbitrary code during model loading; a detailed analysis is available at the provided GitHub link.
0000158
55 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds91d
General
CVE-2025-71348 Remote Code Execution in picklescan Before 0.0.28 via Malicious Pickle Files https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-71348
Post summary
The post notes a remote code execution vulnerability in picklescan versions prior to 0.0.28 that can be triggered by malicious pickle files, but it lacks details about exploit code, patch availability, or active attacks.
0000060
4.1K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	mmaitre314	picklescan	-	-	-

Explore more

Back to dashboard mmaitre314 CVEs picklescan vulnerabilities