--- title: In a pickle: Why every pickle defense in machine... description: Six documented CVE bypasses beat the public defenses against malicious ML model files, including PyTorch's weights_only, Keras's safe_mode, and scanners like... canonical: https://daily.dev/posts/in-a-pickle-why-every-pickle-defense-in-machine-learning-is-bypassed-the-same-way-xvaxd2p7n twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: In a pickle: Why every pickle defense in machine learning is bypassed the same way | daily.dev og:description: Six documented CVE bypasses beat the public defenses against malicious ML model files, including PyTorch's weights_only, Keras's safe_mode, and scanners like... og:url: https://daily.dev/posts/in-a-pickle-why-every-pickle-defense-in-machine-learning-is-bypassed-the-same-way-xvaxd2p7n og:image: https://api.daily.dev/og/posts/xvAXD2P7n.png og:image:alt: In a pickle: Why every pickle defense in machine learning is bypassed the same way og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # In a pickle: Why every pickle defense in machine learning is bypassed the same way **[Sysdig Blog](https://daily.dev/sources/sysdig-blog)** · 19 min read · 0 upvotes · 0 comments ## Summary Six documented CVE bypasses beat the public defenses against malicious ML model files, including PyTorch's weights_only, Keras's safe_mode, and scanners like picklescan. Pickle files aren't data, they're programs: pickle.load() executes opcodes rather than parsing them, so a corrupted or disguised file can still run malicious code before any error appears. CVE-2025-32434 and CVE-2026-24747 (CVSS 8.8) defeated PyTorch's restricted unpickler, while CVE-2025-9905 let Keras ignore safe_mode on legacy .h5 files. A Hugging Face survey of 705,991 models found 51% used pickle-based PyTorch formats. Runtime detection caught all five test gadgets within two seconds in Sysdig Secure, but never observed the deserialization itself, only its consequences. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Is PyTorch's weights_only=True safe from all code execution attacks? No. CVE-2025-32434 found that PyTorch's legacy tar-based loading path (_legacy_load) didn't enforce the restricted unpickler even when weights_only=True was set. Then CVE-2026-24747, with a CVSS score of 8.8, defeated the restricted unpickler itself using crafted opcodes that corrupt memory, affecting every PyTorch version before 2.10.0. _Teams pinning PyTorch versions for security should track CVE advisories on daily.dev before trusting a 'secure default'._ ### Does Keras's safe_mode protect against malicious Lambda layers in model files? Not always. Keras made safe_mode=True the default from version 2.13 to block Lambda layers that carry marshalled Python code, but CVE-2025-9905 showed that loading a legacy .h5 file ignores safe_mode entirely with no warning or error. CVE-2025-9906 found a crafted .keras archive whose config.json calls enable_unsafe_deserialization() and smuggles in a Lambda layer. _Developers deciding whether to trust Keras safe_mode should check CVE history for the format on daily.dev first._ ### Why do antivirus-style scanners like picklescan fail to catch malicious pickle files in ML models? Scanners parse a file one way while the actual loader (like PyTorch or Keras) parses it another way, so an attacker just needs a byte stream that reads differently to each. Sonatype disclosed four picklescan CVEs in 2025 covering extension-based detection bypass, malformed ZIP crashes, and modified ZIP flag bits; ReversingLabs also found malicious models compressed with 7z that picklescan never parsed. _Anyone building ML CI gates can compare scanner bypass techniques on daily.dev before relying on a single check._ ## Similar posts on daily.dev - [Picklescan Bugs Allow Malicious PyTorch Models to Evade Scans and Execute Code](https://daily.dev/posts/picklescan-bugs-allow-malicious-pytorch-models-to-evade-scans-and-execute-code-wivodojdm) · The Hacker News · 0 upvotes · 0 comments - [PyTorch Users at Risk: Unveiling 3 Zero-Day PickleScan Vulnerabilities](https://daily.dev/posts/pytorch-users-at-risk-unveiling-3-zero-day-picklescan-vulnerabilities-edc4yx0ze) · JFrog · 0 upvotes · 0 comments - [Breaking the Jar: Hardening Pickle File Scanners with Structure-Aware Fuzzing](https://daily.dev/posts/breaking-the-jar-hardening-pickle-file-scanners-with-structure-aware-fuzzing-yfqbs6qif) · Cisco · 0 upvotes · 0 comments - [I Found a Tiny Filename Bypass That Broke a “Safe” Loader — and Earned $ $$$](https://daily.dev/posts/i-found-a-tiny-filename-bypass-that-broke-a-safe-loader-and-earned--rafrt5wnz) · Medium · 0 upvotes · 0 comments - [Hugging Face and ClawHub compromised with hundreds of malicious AI models and agent skills as supply chain attacks target AI infrastructure](https://daily.dev/posts/hugging-face-and-clawhub-compromised-with-hundreds-of-malicious-ai-models-and-agent-skills-as-supply-xjnujrk1y) · The Next Web · 4 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#pytorch](https://daily.dev/tags/pytorch), [#keras](https://daily.dev/tags/keras) [View this post on daily.dev](https://daily.dev/posts/in-a-pickle-why-every-pickle-defense-in-machine-learning-is-bypassed-the-same-way-xvaxd2p7n) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"In a pickle: Why every pickle defense in machine learning is bypassed the same way","url":"https://daily.dev/posts/in-a-pickle-why-every-pickle-defense-in-machine-learning-is-bypassed-the-same-way-xvaxd2p7n","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/in-a-pickle-why-every-pickle-defense-in-machine-learning-is-bypassed-the-same-way-xvaxd2p7n"},"datePublished":"2026-10-27T13:50:33.005Z","dateModified":"2026-10-27T13:51:08.047Z","description":"Six documented CVE bypasses beat the public defenses against malicious ML model files, including PyTorch's weights_only, Keras's safe_mode, and scanners like...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f55bf5e60452c487cdea9a7b9f765ef1?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f55bf5e60452c487cdea9a7b9f765ef1?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Sysdig Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Sysdig Blog","logo":"https://media.daily.dev/image/upload/s--1S2uMy2c--/f_auto,q_auto/v1780213305/logos/sysdig-blog?_a=BAMAMiWQ0","url":"https://daily.dev/sources/sysdig-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/in-a-pickle-why-every-pickle-defense-in-machine-learning-is-bypassed-the-same-way-xvaxd2p7n","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,pytorch,keras","timeRequired":"PT19M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Sysdig Blog","item":"https://daily.dev/sources/sysdig-blog"},{"@type":"ListItem","position":3,"name":"In a pickle: Why every pickle defense in machine learning is bypassed the same way"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/in-a-pickle-why-every-pickle-defense-in-machine-learning-is-bypassed-the-same-way-xvaxd2p7n#faq","mainEntity":[{"@type":"Question","name":"Is PyTorch's weights_only=True safe from all code execution attacks?","acceptedAnswer":{"@type":"Answer","text":"No. CVE-2025-32434 found that PyTorch's legacy tar-based loading path (_legacy_load) didn't enforce the restricted unpickler even when weights_only=True was set. Then CVE-2026-24747, with a CVSS score of 8.8, defeated the restricted unpickler itself using crafted opcodes that corrupt memory, affecting every PyTorch version before 2.10.0. Teams pinning PyTorch versions for security should track CVE advisories on daily.dev before trusting a 'secure default'."}},{"@type":"Question","name":"Does Keras's safe_mode protect against malicious Lambda layers in model files?","acceptedAnswer":{"@type":"Answer","text":"Not always. Keras made safe_mode=True the default from version 2.13 to block Lambda layers that carry marshalled Python code, but CVE-2025-9905 showed that loading a legacy .h5 file ignores safe_mode entirely with no warning or error. CVE-2025-9906 found a crafted .keras archive whose config.json calls enable_unsafe_deserialization() and smuggles in a Lambda layer. Developers deciding whether to trust Keras safe_mode should check CVE history for the format on daily.dev first."}},{"@type":"Question","name":"Why do antivirus-style scanners like picklescan fail to catch malicious pickle files in ML models?","acceptedAnswer":{"@type":"Answer","text":"Scanners parse a file one way while the actual loader (like PyTorch or Keras) parses it another way, so an attacker just needs a byte stream that reads differently to each. Sonatype disclosed four picklescan CVEs in 2025 covering extension-based detection bypass, malformed ZIP crashes, and modified ZIP flag bits; ReversingLabs also found malicious models compressed with 7z that picklescan never parsed. Anyone building ML CI gates can compare scanner bypass techniques on daily.dev before relying on a single check."}}]} ```