CVE-2025-71348 picklescan - Arbitrary Code Execution via torch.utils._config_module.load_config Bypass

High 7.6 Published 21 Jun 2026 Updated 22 Jun 2026

Attackers can bypass picklescan detection to execute arbitrary code via malicious pickle files, posing a supply chain risk.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2025-71348?

CVE-2025-71348 is a high-severity unsafe deserialization vulnerability in picklescan, published on 21 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methods. Attackers can craft pickle files embedding arbitrary code that evades detection but executes during pickle.load, enabling remote code execution in supply chain attacks.

Weakness: CWE-502

Which versions are affected by CVE-2025-71348?

3 open source packages ship an affected version, including picklescan. It affects 1 product.

Package	Affected	Fixed in
`picklescan` PyPI	All versions	`0.0.28`
`picklescan` PyPI	All versions	`0.0.28`
`picklescan` PyPI	All versions	`0.0.28`

Products include Mmaitre314 Picklescan.

How do I fix CVE-2025-71348?

Upgrade picklescan to 0.0.28 or later.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2025-71348 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-71348 exists.

Sources

Also known as GHSA-vv6j-3g6g-2pvj, PYSEC-2026-245.