Which versions of picklescan are affected by CVE-2026-53874?

picklescan versions prior to 1.0.1 contain a critical arbitrary code execution vulnerability (CVSS 9.3) with publicly available exploit code, allowing attackers to bypass the scanner's malicious…. A patch is available.

How to fix or mitigate CVE-2026-53874?

24 hours: Identify all systems running picklescan < 1.0.1 and restrict network access to pickle processing endpoints; disable pickle deserialization where operationally feasible. 7 days: Contact picklescan maintainers for patch release timeline; evaluate alternative detection mechanisms (bandit, custom validators, Protocol Buffers). 30 days: Upgrade to picklescan 1.0.1 upon release or implement compensating controls on all vulnerable systems; conduct inventory of pickle usage across applications.

picklescan CVE-2026-53874

Q: What is the CVSS score of CVE-2026-53874?

CVE-2026-53874 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-17 VulnCheck

Deserialization RCE Picklescan

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.6 CRITICAL

Network-delivered malicious pickle reaches the victim with low complexity and no auth, but a user/process must load the pickle (UI:R); scope changes because picklescan's verdict is consumed by another component, and impact is full RCE.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 17, 2026 - 16:51 vuln.today

Analysis Generated

Jun 17, 2026 - 16:51 vuln.today

DescriptionCVE.org

picklescan before 1.0.1 contains an unsafe deserialization vulnerability allowing unauthenticated users to execute arbitrary code by hiding eval calls nested under callable objects via getattr. Attackers can embed malicious code in pickle files that evades detection but executes when the pickle is loaded from untrusted sources.

AnalysisAI

Arbitrary code execution in picklescan versions prior to 1.0.1 allows attackers to bypass the scanner's malicious pickle detection by obfuscating eval calls nested under callable objects via getattr, causing the very tool intended to detect malicious pickles to miss them. Publicly available exploit code exists via the GHSA advisory PoC, though no public exploit identified at time of analysis as actively used in attacks; the CVSS 4.0 score of 9.3 reflects unauthenticated network-reachable impact on confidentiality, integrity, and availability.

Technical ContextAI

picklescan is a Python library (distributed via pip) designed to statically analyze pickle files for unsafe opcodes and dangerous imports such as builtins.eval, os.system, and subprocess calls before deserialization. The vulnerability is a CWE-502 (Deserialization of Untrusted Data) detection-bypass: the scanner's import/global-tracking logic only flags directly-referenced dangerous callables, so wrapping the call as getattr(builtins, 'eval')(payload) inside a static method referenced through __reduce__ hides the eval symbol from the scanner's allowlist/denylist checks while pickle.loads still resolves and invokes it at load time. The affected CPE is cpe:2.3:a:picklescan:picklescan:*:*:*:*:*:*:*:* covering all versions before 1.0.1.

RemediationAI

Vendor-released patch: upgrade picklescan to version 1.0.1 or later via pip (pip install --upgrade picklescan>=1.0.1); the fix landed in PR https://github.com/mmaitre314/picklescan/pull/59 and commit 173c8f2a869ea9b69b543477525ec70611c3c6f4. Until upgrade is possible, treat picklescan's clean verdict as advisory only and refuse to deserialize pickles from untrusted publishers, or switch model-loading code to safer formats such as safetensors for PyTorch weights (trade-off: requires re-saving models and may break compatibility with checkpoints that embed Python objects). As a hardening layer, run pickle.load in a sandboxed subprocess with seccomp/AppArmor restricting exec, network, and file writes - this contains RCE even if a scanner bypass succeeds but adds latency to model loading.