CVE-2025-1716 is a critical flaw in picklescan, the Python tool that checks pickle files for unsafe code. Before the fix it did not treat pip as an unsafe global, so a hostile model file could pass the scan. The GitHub advisory lists 0.0.22 as the patched release, while the CVE text says before 0.0.21.
What's affected
picklescan is a Python package that scans pickle files, often model files, for dangerous imports before you load them. The weakness is that its list of unsafe globals left out pip, so a pickle that calls into pip was not flagged.
- Product: picklescan (mmaitre314/picklescan on PyPI)
- Affected: the CVE record says before 0.0.21. The GitHub advisory says affected versions below 0.0.22 and lists 0.0.22 as patched.
- Fixed: 0.0.22 per the advisory. Because the two sources disagree by one release, use 0.0.22 or later.
- Severity: Critical, CVSS 9.8 in the record (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The GitHub advisory rates it Moderate at 5.3 under CVSS v4, so scores differ by source.
- Known exploited (CISA KEV): no, the record's kev flag is false
The advisory describes the issue as an unsafe deserialization problem where the scanner can be bypassed. The scanner is the thing that fails here, not Python's pickle module itself. Pickle has always been able to run code on load, which is why scanners like this exist.
How to check if you're exposed
Start with the version of the scanner in each environment that uses it.
pip show picklescan
pip list | grep -i picklescan
Then look for places it is used as a gate: CI jobs, model registries, upload pipelines and notebooks that scan a file before loading it. Search your repositories for the package name in requirements files and lock files.
grep -rn "picklescan" --include=requirements*.txt --include=pyproject.toml --include=poetry.lock --include=Pipfile.lock .
If your pipeline accepted pickle based model files from outside while running a vulnerable version, the scan result for those files cannot be trusted. Keep a list of what was scanned and when.
What to do now
- Upgrade picklescan to 0.0.22 or later in every environment, with
pip install --upgrade "picklescan>=0.0.22", and pin it in your lock file. - Rescan files that were accepted while an older version was in place, using the new version.
- Prefer formats that cannot run code on load, such as safetensors, for models you accept from others.
- Never load a pickle from an untrusted source on a machine with network access or secrets, even if a scan passed.
- Review the machines that loaded any outside pickle after the fix window for unexpected package installs. The advisory describes the bypass as installing a package through pip, so look at recent pip activity and package lists.
- Treat a clean scan as one signal, not permission. Scanners work from lists, and lists miss things.
Why it matters
The weakness is an incomplete denylist (CWE-184). A scanner that blocks known dangerous imports only protects against the imports on its list. Anything legitimate looking that can be abused, and is missing from the list, gets through. Here the missing entry was pip, a tool that installs other packages.
The practical lesson is about trust. A scan that says safe is only as good as its list, and pickle is a format where the safe answer is to not load untrusted files at all. The same lesson applies to your own pipeline: if a control is the only thing between outside files and code execution, add a second one.
The record maps this to CWE-184 (Incomplete List of Disallowed Inputs). Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan for projects that pull this kind of component in through a package manager.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2025-1716 exploited in the wild?
The record's CISA KEV flag is false and neither the record nor the advisory says it is being exploited. The advisory does describe how the bypass works in general terms, so assume details are public.
Which picklescan version should I run?
The advisory lists 0.0.22 as the patched version, while the CVE text says before 0.0.21. Run 0.0.22 or later to cover both.
Sources
- Safeguard Gold entry for CVE-2025-1716
- GitHub advisory GHSA-655q-fx9r-782v
- Fix commit and Sonatype advisory, both listed in the record and not fetched for this page
Last reviewed: 19 October 2026.
