picklescan
CVE-2026-53872
HIGH
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote attacker delivers a pickle but a user/automation must invoke the scanner on it (UI:R); no auth needed; only confidentiality impact via arbitrary file read.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
picklescan before 0.0.35 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to read arbitrary server files by chaining io.FileIO and urllib.request.urlopen. Attackers can bypass RCE-focused blocklists to exfiltrate sensitive data like /etc/passwd to external servers.
AnalysisAI
Arbitrary file read in picklescan versions before 0.0.35 allows remote unauthenticated attackers to exfiltrate sensitive server files by abusing standard-library callables that the tool's RCE-focused blocklist fails to detect. By chaining io.FileIO and urllib.request.urlopen inside a malicious pickle, an attacker can stream contents of files such as /etc/passwd to an attacker-controlled URL when the scanner processes untrusted model artifacts. Publicly available exploit code exists in the GHSA advisory, but there is no public exploit identified at time of analysis in the form of in-the-wild abuse.
Technical ContextAI
picklescan is a Python package (pip/picklescan, CPE cpe:2.3:a:picklescan:picklescan:*) designed to statically scan pickle files - commonly distributed with ML models on Hugging Face and similar hubs - for unsafe deserialization payloads. The vulnerability is rooted in CWE-22 (Path Traversal) combined with unsafe pickle deserialization: the scanner's allow/block heuristics focus on classic RCE primitives (os, subprocess, builtins.exec) and miss io.FileIO, which opens arbitrary local files without going through builtins.open, and urllib.request.urlopen, which accepts a file-like iterable as a POST body. Chaining them inside __reduce__ produces a pickle whose unpickling reads a chosen path and ships it to an external HTTP endpoint, defeating the scanner's purpose of declaring such files safe.
RemediationAI
Vendor-released patch: picklescan 0.0.35 - upgrade via pip install --upgrade 'picklescan>=0.0.35' and rebuild any container images, CI workers, or Hugging Face integration services that bundle the library. The upstream fix is tracked in PR https://github.com/mmaitre314/picklescan/pull/55 and commit a01c58d5dd7960db557b849817c0ab83ab111ef1, referenced from the GHSA advisory at https://github.com/mmaitre314/picklescan/security/advisories/GHSA-9726-w42j-3qjr. Until the upgrade is rolled out, do not rely on picklescan's verdict alone for untrusted pickles: run scans inside a sandbox or container with no network egress and a minimal filesystem (so urllib.request.urlopen cannot reach the internet and io.FileIO has nothing sensitive to read), or block outbound HTTP from the scanner host at the network layer - the trade-off is that legitimate scanner functionality is unaffected but you lose visibility if you also need the scanner to fetch remote artifacts.
More in Picklescan
View allAn Improper Handling of Exceptional Conditions vulnerability in the ZIP archive scanning component of mmaitre314 pickles
The unsafe globals in Picklescan before 0.0.25 do not include ssl. Rated medium severity (CVSS 6.8), this vulnerability
picklescan before 0.0.21 does not treat 'pip' as an unsafe global. Rated medium severity (CVSS 5.3), this vulnerability
Remote code execution against users of picklescan versions prior to 1.0.4 is achievable by smuggling any blocked functio
Arbitrary code execution in picklescan versions prior to 1.0.1 allows attackers to bypass the scanner's malicious pickle
picklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. Rated m
Remote code execution in picklescan versions prior to 1.0.4 allows attackers to bypass the scanner's safety validation b
Arbitrary code execution bypass in picklescan before 1.0.4 allows attackers to smuggle malicious pickle files past the s
Detection bypass in picklescan versions prior to 0.0.27 allows attackers to smuggle malicious Python pickle files past t
Remote code execution in picklescan before 0.0.33 enables attackers to bypass the tool's malicious-pickle detection by s
Arbitrary file write in picklescan before 0.0.33 lets attackers bypass the tool's dangerous-call blocklist by abusing di
Arbitrary code execution in picklescan before 0.0.33 allows remote attackers to bypass the scanner's malicious-pickle de
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today