Picklescan Bugs Allow Malicious PyTorch Models to Evade Scans and Execute Code

Three critical flaws disclosed in the open‑source Picklescan utility could let attackers load untrusted PyTorch models, bypassing the scanner and executing arbitrary code, potentially enabling large‑scale supply‑chain attacks.

The vulnerabilities—CVE-2025-10155 (file extension bypass with PyTorch extensions), CVE-2025-10156 (CRC error bypass to disable ZIP scanning), and CVE-2025-10157 (unsafe globals bypass to defeat a blocklist and enable code execution)—carry CVSS scores of 9.3/7.8, 9.3/7.5, and 9.3/8.3 respectively.

Following responsible disclosure on 29 June 2025, they were addressed in version 0.0.31, released on 9 September, with security researcher David Cohen describing how each flaw enables attackers to evade detection and conceal malicious payloads in PyTorch models. Picklescan works by examining pickle files at bytecode level and comparing results against a blocklist of hazardous imports and operations, a method that can preclude new attack vectors and leave security architectures vulnerable if relied on alone.

The findings highlight systemic issues, including reliance on a single scanning tool and discrepancies between security tools and PyTorch file handling, underscoring the need for ongoing, research‑driven protection for AI models.