picklescan
CVE-2026-3490
CRITICAL
GHSA-vvpj-8cmc-gx39
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker delivers a malicious pickle over the network with no privileges or user interaction beyond the normal scan-then-load workflow; scope changes because the scanner's failure causes RCE in the consuming process, with full CIA impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2Blast Radius
ecosystem impact- 3 pypi packages depend on picklescan (3 direct, 0 indirect)
Ecosystem-wide dependent count for version 1.0.4.
DescriptionCVE.org
picklescan before 1.0.4 fails to block pkgutil.resolve_name, allowing attackers to bypass the entire blocklist by resolving any dangerous function through indirect REDUCE calls. Remote attackers can invoke any blocked function such as os.system, builtins.exec, or subprocess.call to achieve remote code execution.
AnalysisAI
Remote code execution against users of picklescan versions prior to 1.0.4 is achievable by smuggling any blocked function past its scanner using pkgutil.resolve_name as an indirection primitive. Because pkgutil.resolve_name is not on the blocklist, an attacker can chain two REDUCE opcodes to resolve and invoke os.system, builtins.exec, subprocess.call, or any other dangerous function while the scanner reports the pickle as CLEAN - a universal blocklist bypass that defeats picklescan's entire safety premise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the victim run picklescan version 1.0.3 or earlier as a gating control over an attacker-controlled pickle file and then unpickle (or otherwise execute) that file after picklescan reports it clean - picklescan itself does not execute the payload, it only fails to flag it. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals converge on a real, high-priority risk rather than a paper score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker uploads a malicious PyTorch model or pickle artifact to a public model hub; the target organization's MLOps pipeline runs picklescan 1.0.3 over the file and reports CLEAN because only pkgutil.resolve_name appears in the opcode stream. When the model is subsequently torch.loaded, the chained REDUCEs execute os.system('curl … | sh') in the training or inference container, giving the attacker code execution under the service account - the GHSA advisory publishes the exact two-REDUCE pickle template, so adapting it requires no novel research. |
| Remediation | Upgrade picklescan to the vendor-released patched version 1.0.4 from PyPI (pip install --upgrade 'picklescan>=1.0.4'), which adds pkgutil.resolve_name (and related indirection primitives) to the blocklist - see https://github.com/mmaitre314/picklescan/security/advisories/GHSA-vvpj-8cmc-gx39 for advisory details. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Identify all systems running picklescan versions prior to 1.0.4 and classify by network exposure; immediately restrict pickle deserialization to trusted internal sources only and enforce strict input validation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Arbitrary code execution in picklescan versions prior to 1.0.1 allows attackers to bypass the scanner's malicious pickle
Arbitrary code execution in picklescan before 0.0.33 allows remote attackers to bypass the scanner's malicious-pickle de
Arbitrary file write in picklescan before 0.0.33 lets attackers bypass the tool's dangerous-call blocklist by abusing di
Remote code execution in picklescan before 0.0.33 enables attackers to bypass the tool's malicious-pickle detection by s
Detection bypass in picklescan versions prior to 0.0.27 allows attackers to smuggle malicious Python pickle files past t
Share
External POC / Exploit Code
Leaving vuln.today