CVE-2025-71353: picklescan - Remote Code Execution via torch._dynamo.guards.GuardBuilder.get
picklescan before 0.0.28 fails to detect malicious pickle files that exploit torch.dynamo.guards.GuardBuilder.get function in reduce methods. Attackers can craft pickle files with embedded code that evades picklescan detection and executes arbitrary commands when loaded.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71353?
The severity of CVE-2025-71353 is rated as high with a score of 8.1.
How does CVE-2025-71353 allow remote code execution?
CVE-2025-71353 allows remote code execution by exploiting the torch._dynamo.guards.GuardBuilder.get function in picklescan through malicious pickle files.
What versions of picklescan are affected by CVE-2025-71353?
CVE-2025-71353 affects all versions of picklescan prior to 0.0.28.
How can I protect my system from CVE-2025-71353?
To protect your system from CVE-2025-71353, you should update picklescan to version 0.0.28 or later.
What impact does CVE-2025-71353 have on data integrity?
CVE-2025-71353 impacts data integrity by allowing attackers to execute arbitrary commands, which could lead to unauthorized access or corruption of data.