AI model scanning has long been considered the first layer of security in machine learning environments.
However, three critical zero-day vulnerabilities discovered in PickleScan the industry-standard tool for scanning PyTorch models have exposed dangerous blind spots in this critical defense mechanism.
JFrog Security Research identified these vulnerabilities, which allow sophisticated attackers to completely bypass PickleScan’s malware detection and distribute malicious machine learning models undetected across major platforms like Hugging Face.
Each vulnerability enables attackers to execute arbitrary code when victims load compromised PyTorch models, creating a pathway for large-scale supply chain attacks across the AI community.
The PyTorch Security Problem
PyTorch models rely on Python’s “pickle” serialization format, which presents a fundamental security risk: pickle files can embed and execute arbitrary Python code during deserialization.
An attacker can disguise malicious code inside seemingly harmless model files. When loaded, these files execute the embedded code, potentially exfiltrating data, installing backdoors, or compromising entire systems.
With over 200,000 PyTorch models hosted on Hugging Face and countless others distributed privately, the attack surface is enormous.
PickleScan emerged as the industry standard defense parsing pickle bytecode to detect dangerous operations before execution. However, recent research reveals this critical tool contains exploitable flaws.
| CVE ID | Vulnerability | CVSS Score | Severity | Attack Method |
|---|---|---|---|---|
| CVE-2025-10155 | File Extension Bypass | 9.3 | Critical | Rename malicious .pkl files to .bin/.pt extensions; PickleScan fails while PyTorch loads successfully |
| CVE-2025-10156 | CRC Bypass in ZIP Archives | 9.3 | Critical | Introduce CRC errors into archives; PickleScan crashes while PyTorch ignores and loads the model |
| CVE-2025-10157 | Unsafe Globals Subclass Import Bypass | 9.3 | Critical | Use dangerous module subclasses instead of exact names; evades blacklist detection |
These vulnerabilities represent a critical systemic weakness in AI security infrastructure. The widespread reliance on PickleScan creates a single point of failure affecting millions of organizations globally.
Attackers exploiting these flaws could conduct massive supply chain attacks, with malicious models bypassing security scans at major AI repositories.
The vulnerabilities demonstrate that security tools cannot be trusted as standalone defenses when they handle files differently than the target applications.
The gap between how PickleScan and PyTorch process files has created exploitable security blind spots.
Organizations should immediately implement layered defenses: update PickleScan to version 0.0.31 (where fixes were applied), transition to safer formats like Safetensors, sandbox model loading environments, and deploy repository proxies for additional scanning layers.
Single-point security solutions are no longer sufficient in the modern AI threat landscape.
Find this Story Interesting! Follow us on Google News, LinkedIn and X to Get More Instant Updates
%20(1).webp?fit=1600,900&ssl=1&description=JFrog Security Research identified these vulnerabilities, which allow sophisticated attackers to completely bypass PickleScan's){kind=link}