picklescan
CVE-2026-53872
HIGH
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote attacker delivers a pickle but a user/automation must invoke the scanner on it (UI:R); no auth needed; only confidentiality impact via arbitrary file read.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
picklescan before 0.0.35 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to read arbitrary server files by chaining io.FileIO and urllib.request.urlopen. Attackers can bypass RCE-focused blocklists to exfiltrate sensitive data like /etc/passwd to external servers.
AnalysisAI
Arbitrary file read in picklescan versions before 0.0.35 allows remote unauthenticated attackers to exfiltrate sensitive server files by abusing standard-library callables that the tool's RCE-focused blocklist fails to detect. By chaining io.FileIO and urllib.request.urlopen inside a malicious pickle, an attacker can stream contents of files such as /etc/passwd to an attacker-controlled URL when the scanner processes untrusted model artifacts. Publicly available exploit code exists in the GHSA advisory, but there is no public exploit identified at time of analysis in the form of in-the-wild abuse.
Technical ContextAI
picklescan is a Python package (pip/picklescan, CPE cpe:2.3:a:picklescan:picklescan:*) designed to statically scan pickle files - commonly distributed with ML models on Hugging Face and similar hubs - for unsafe deserialization payloads. The vulnerability is rooted in CWE-22 (Path Traversal) combined with unsafe pickle deserialization: the scanner's allow/block heuristics focus on classic RCE primitives (os, subprocess, builtins.exec) and miss io.FileIO, which opens arbitrary local files without going through builtins.open, and urllib.request.urlopen, which accepts a file-like iterable as a POST body. Chaining them inside __reduce__ produces a pickle whose unpickling reads a chosen path and ships it to an external HTTP endpoint, defeating the scanner's purpose of declaring such files safe.
RemediationAI
Vendor-released patch: picklescan 0.0.35 - upgrade via pip install --upgrade 'picklescan>=0.0.35' and rebuild any container images, CI workers, or Hugging Face integration services that bundle the library. The upstream fix is tracked in PR https://github.com/mmaitre314/picklescan/pull/55 and commit a01c58d5dd7960db557b849817c0ab83ab111ef1, referenced from the GHSA advisory at https://github.com/mmaitre314/picklescan/security/advisories/GHSA-9726-w42j-3qjr. Until the upgrade is rolled out, do not rely on picklescan's verdict alone for untrusted pickles: run scans inside a sandbox or container with no network egress and a minimal filesystem (so urllib.request.urlopen cannot reach the internet and io.FileIO has nothing sensitive to read), or block outbound HTTP from the scanner host at the network layer - the trade-off is that legitimate scanner functionality is unaffected but you lose visibility if you also need the scanner to fetch remote artifacts.
More in Picklescan
View allAn Improper Handling of Exceptional Conditions vulnerability in the ZIP archive scanning component of mmaitre314 pickles
A Protection Mechanism Failure vulnerability in mmaitre314 picklescan versions up to and including 0.0.30 allows a remot
An Improper Input Validation vulnerability in the scanning logic of mmaitre314 picklescan versions up to and including 0
Detection bypass in picklescan prior to 0.0.29 allows attackers to smuggle remote code execution payloads through pickle
Detection bypass in picklescan versions before 0.0.25 allows attackers to embed remote code execution payloads in pickle
Detection bypass in picklescan before 0.0.28 allows attackers to embed malicious torch.jit.unsupported_tensor_ops.execWr
Detection bypass in picklescan before 0.0.28 allows attackers to smuggle arbitrary code through pickle files by abusing
Detection bypass in picklescan before 0.0.29 allows malicious pickle files to evade scanning by abusing the undetected i
Detection bypass in picklescan versions before 0.0.30 allows malicious pickle files to evade security scanning by using
Detection bypass in picklescan versions prior to 0.0.29 allows attackers to smuggle arbitrary code execution payloads th
Detection bypass in picklescan before 0.0.33 allows attackers to smuggle arbitrary code through malicious pickle files b
Detection bypass in picklescan before 0.0.29 allows attackers to craft malicious pickle files using idlelib.debugobj.Obj
Same weakness CWE-22 – Path Traversal
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today