picklescan
CVE-2026-53874
CRITICAL
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered malicious pickle reaches the victim with low complexity and no auth, but a user/process must load the pickle (UI:R); scope changes because picklescan's verdict is consumed by another component, and impact is full RCE.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
picklescan before 1.0.1 contains an unsafe deserialization vulnerability allowing unauthenticated users to execute arbitrary code by hiding eval calls nested under callable objects via getattr. Attackers can embed malicious code in pickle files that evades detection but executes when the pickle is loaded from untrusted sources.
AnalysisAI
Arbitrary code execution in picklescan versions prior to 1.0.1 allows attackers to bypass the scanner's malicious pickle detection by obfuscating eval calls nested under callable objects via getattr, causing the very tool intended to detect malicious pickles to miss them. Publicly available exploit code exists via the GHSA advisory PoC, though no public exploit identified at time of analysis as actively used in attacks; the CVSS 4.0 score of 9.3 reflects unauthenticated network-reachable impact on confidentiality, integrity, and availability.
Technical ContextAI
picklescan is a Python library (distributed via pip) designed to statically analyze pickle files for unsafe opcodes and dangerous imports such as builtins.eval, os.system, and subprocess calls before deserialization. The vulnerability is a CWE-502 (Deserialization of Untrusted Data) detection-bypass: the scanner's import/global-tracking logic only flags directly-referenced dangerous callables, so wrapping the call as getattr(builtins, 'eval')(payload) inside a static method referenced through __reduce__ hides the eval symbol from the scanner's allowlist/denylist checks while pickle.loads still resolves and invokes it at load time. The affected CPE is cpe:2.3:a:picklescan:picklescan:*:*:*:*:*:*:*:* covering all versions before 1.0.1.
RemediationAI
Vendor-released patch: upgrade picklescan to version 1.0.1 or later via pip (pip install --upgrade picklescan>=1.0.1); the fix landed in PR https://github.com/mmaitre314/picklescan/pull/59 and commit 173c8f2a869ea9b69b543477525ec70611c3c6f4. Until upgrade is possible, treat picklescan's clean verdict as advisory only and refuse to deserialize pickles from untrusted publishers, or switch model-loading code to safer formats such as safetensors for PyTorch weights (trade-off: requires re-saving models and may break compatibility with checkpoints that embed Python objects). As a hardening layer, run pickle.load in a sandboxed subprocess with seccomp/AppArmor restricting exec, network, and file writes - this contains RCE even if a scanner bypass succeeds but adds latency to model loading.
More in Picklescan
View allAn Improper Handling of Exceptional Conditions vulnerability in the ZIP archive scanning component of mmaitre314 pickles
A Protection Mechanism Failure vulnerability in mmaitre314 picklescan versions up to and including 0.0.30 allows a remot
An Improper Input Validation vulnerability in the scanning logic of mmaitre314 picklescan versions up to and including 0
Detection bypass in picklescan prior to 0.0.29 allows attackers to smuggle remote code execution payloads through pickle
Detection bypass in picklescan versions before 0.0.25 allows attackers to embed remote code execution payloads in pickle
Detection bypass in picklescan before 0.0.28 allows attackers to embed malicious torch.jit.unsupported_tensor_ops.execWr
Detection bypass in picklescan before 0.0.28 allows attackers to smuggle arbitrary code through pickle files by abusing
Detection bypass in picklescan before 0.0.29 allows malicious pickle files to evade scanning by abusing the undetected i
Detection bypass in picklescan versions before 0.0.30 allows malicious pickle files to evade security scanning by using
Detection bypass in picklescan versions prior to 0.0.29 allows attackers to smuggle arbitrary code execution payloads th
Detection bypass in picklescan before 0.0.33 allows attackers to smuggle arbitrary code through malicious pickle files b
Detection bypass in picklescan before 0.0.29 allows attackers to craft malicious pickle files using idlelib.debugobj.Obj
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today