Three critical vulnerabilities in PickleScan bypass malware detection
JFrog Security Research disclosed three critical zero-day vulnerabilities in PickleScan, a widely-used tool for scanning PyTorch models, that allow attackers to bypass malware detection and distribute malicious machine learning models. The flaws exploit differences in how PickleScan and PyTorch handle file extensions, ZIP archive processing, and module imports, potentially enabling large-scale AI supply chain attacks.
What happened
JFrog Security Research disclosed three critical zero-day vulnerabilities in PickleScan, each with a CVSS rating of 9.3. CVE-2025-10155 involved a file extension bypass where renaming a malicious pickle file to a PyTorch extension such as .bin or .pt caused PickleScan to misclassify the file and hand it to PyTorch-specific parsing logic, resulting in a failed scan while PyTorch loaded the file normally.
CVE-2025-10156 exposed a gap in how PickleScan and PyTorch process ZIP archives. PickleScan relied on Python's zipfile module which threw exceptions when encountering Cyclic Redundancy Check errors, while PyTorch ignored these mismatches, allowing a corrupted archive with malicious code to load successfully.
CVE-2025-10157 allowed attackers to evade PickleScan's blacklist of dangerous imports by calling a subclass of a flagged module instead of referencing it directly, leading the scanner to label it only as 'Suspicious' rather than 'Dangerous'. The vulnerabilities were disclosed to PickleScan maintainers on 29 June 2025 and patched on 2 September 2025.
Reported impact
The vulnerabilities could enable attackers to distribute malicious machine learning models that evade detection and potentially execute large-scale supply chain attacks across major model hubs such as Hugging Face. Loading an untrusted PyTorch model containing malicious pickle code could perform harmful actions on a system, such as exfiltrating sensitive data or installing backdoors.
Index analysis
PickleScan is the industry-standard open-source tool for scanning pickle-based models and ensuring they contain no malicious content. The flaws highlight systemic risks including reliance on a single scanning tool and divergent file-handling behavior between security tools and machine learning frameworks.
Governance controls
JFrog recommended updating PickleScan to version 0.0.31 and adopting layered defenses. The vendor also advised shifting to safer serialization formats such as Safetensors, which do not allow arbitrary code execution during deserialization.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.