Which versions of picklescan are affected by CVE-2026-53873?

picklescan, a critical security scanner for Python pickle files, contains a code execution bypass that completely nullifies its protective capability; publicly available exploit code exists in the…. A patch is available.

How to fix or mitigate CVE-2026-53873?

Within 24 hours: Immediately disable picklescan as a security control and implement alternative mitigation (block pickle deserialization, restrict to whitelisted types, enforce code review of pickle sources). Within 7 days: Audit all systems and data sources validated by picklescan over the past 6-12 months to identify exposure window. Within 30 days: Monitor picklescan releases for 1.0.4 or later; deploy once vendor confirms the bypass is resolved, following security review.

picklescan CVE-2026-53873

Q: What is the CVSS score of CVE-2026-53873?

CVE-2026-53873 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

CRITICAL

Incomplete List of Disallowed Inputs (CWE-184)

2026-06-17 VulnCheck

GHSA-7wx9-6375-f5wh

Python RCE Picklescan

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Bypass lets attacker-supplied pickle reach pickle.loads via a default-config scanner with no auth or user interaction, yielding full RCE on the loader host (C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 17, 2026 - 16:50 vuln.today

Analysis Generated

Jun 17, 2026 - 16:50 vuln.today

DescriptionCVE.org

picklescan before 1.0.4 contains an incomplete blocklist for the profile module that fails to block the module-level profile.run() function, allowing attackers to achieve arbitrary code execution via exec(). Attackers can craft malicious pickle files calling profile.run(statement) to execute arbitrary Python code while picklescan reports zero security issues.

Articles & Coverage 1

News Critical Arbitrary Code Execution Bypass in picklescan before 1.0.4 - CVE-2026-53873 Jun 18, 2026

AnalysisAI

Arbitrary code execution bypass in picklescan before 1.0.4 allows attackers to smuggle malicious pickle files past the scanner by invoking the module-level profile.run() function, which is missing from the blocklist that only covers Profile.run and Profile.runctx. The scanner reports zero issues while pickle.loads() triggers exec() of attacker-controlled Python. No public exploit identified at time of analysis beyond the proof-of-concept in the GHSA advisory, and the issue is not listed in CISA KEV.

Technical ContextAI

picklescan is a Python package (cpe:2.3:a:picklescan:picklescan) used by ML pipelines and model hubs to statically inspect pickle files for dangerous globals before deserialization. The flaw is a CWE-184 (Incomplete List of Disallowed Inputs) defect in scanner.py: the blocklist for the profile module is the set {"Profile.run", "Profile.runctx"}, and the matcher does an exact string membership check (g.name in unsafe_filter) against the pickle global name. Because a pickle referencing profile.run resolves the global name as "run" (not "Profile.run"), the check fails open. The underlying primitive is Python's profile.run(statement), which internally calls exec(statement), turning any tolerated pickle global into a generic code-execution sink.

RemediationAI

Vendor-released patch: upgrade picklescan to 1.0.4 or later, which extends the profile blocklist to also cover the module-level run function (advisory GHSA-7wx9-6375-f5wh). Until the upgrade is rolled out across CI, model-registry scanners, and developer environments, treat scanner output as advisory only and refuse to deserialize untrusted pickle files at all, or wrap loading with a restricted Unpickler.find_class allowlist that rejects the profile module entirely; both controls cost legitimate use of profile-based pickles, which is rare. Where picklescan is embedded as a gate in an ML model ingestion pipeline (for example Hugging Face mirrors or internal registries), pin the resolved dependency to >=1.0.4 and re-scan previously cleared artifacts since prior "clean" verdicts cannot be trusted.