PickleScan Uncovers 0-Day Vulnerabilities Allowing Arbitrary Code Execution via Malicious PyTorch Models
JFrog Security Research has identified three critical zero-day vulnerabilities in PickleScan, a widely-used tool for scanning machine learning models to detect malicious content. These vulnerabilities allow attackers to bypass PickleScan's malware…
JFrog Security Research has identified three critical zero-day vulnerabilities in PickleScan, a widely-used tool for scanning machine learning models to detect malicious content. These vulnerabilities allow attackers to bypass PickleScan's malware detection mechanisms, potentially leading to large-scale supply chain attacks through the distribution of malicious ML models.
PickleScan is designed to analyze pickle files, which are used in the Python programming language for serializing and deserializing objects. However, the flexibility of pickle files also poses a security risk, as they can embed and execute arbitrary Python code during deserialization. This risk becomes significant when users load untrusted PyTorch models, potentially executing malicious code that could exfiltrate data or compromise systems.
CVE-2025-10155 (CVSS 9.3): This vulnerability exploits PickleScan's file type detection logic. By renaming a malicious pickle file with a PyTorch-related extension such as .bin or .pt, attackers can bypass PickleScan's scanner while PyTorch loads the file successfully. CVE-2025-10156 (CVSS 9.3): Involves CRC errors in ZIP archives, where PickleScan fails when encountering CRC mismatches. This allows PyTorch to load files that PickleScan marks as unscanned. CVE-2025-10157 (CVSS 9.3): This vulnerability involves circumventing PickleScan's unsafe globals check by using subclasses of dangerous imports, allowing malicious payloads to be categorized as "suspicious" rather than "dangerous".
PickleScan is designed to analyze pickle files, which are used in the Python programming language for serializing and deserializing objects.
These vulnerabilities highlight deeper issues within the AI security infrastructure. Organizations relying on platforms like Hugging Face, which use PickleScan for model scanning, are particularly vulnerable. The discrepancies between security tools and applications can create exploitable gaps, underscoring the need for comprehensive security strategies.
Update to PickleScan version 0.0.31 to address these vulnerabilities. Implement layered defenses, including sandboxed environments and secure model repository proxies. Consider migrating to safer ML model formats such as Safetensors. Employ automated removal of failed security scans. Adopt defense-in-depth strategies to enhance protection.
Based on reporting by GBHackers.