picklescan
CVE-2026-53875
HIGH
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Malicious model is delivered over the network with no auth to the scanner (AV:N/PR:N), but the victim must invoke torch.load with unsafe deserialization (UI:R); successful __reduce__ yields full code execution, so C/I/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
picklescan before 1.0.3 contains a scanning bypass vulnerability in the scan_pytorch function that allows attackers to embed malicious magic numbers via dynamic eval using the __reduce__ trick. Attackers can craft malicious PyTorch payloads that evade picklescan detection while remaining executable, enabling arbitrary code execution when loaded with torch.load().
AnalysisAI
Scanner evasion in picklescan versions prior to 1.0.3 lets an attacker smuggle malicious PyTorch pickle payloads past the scan_pytorch detection routine and gain arbitrary code execution when the model is later loaded with torch.load(). The bypass exploits a parser-differential between picklescan's pickletools.genops()-based magic-number extraction and PyTorch's pickle_module.load(), allowing a __reduce__(eval, ('MAGIC_NUMBER',)) trick to produce files that scan as clean but still deserialize correctly. A detailed proof-of-concept is published in the GHSA advisory and the VulnCheck writeup; no CISA KEV listing or EPSS score was supplied in the input.
Technical ContextAI
picklescan is a Python pickle malware scanner widely used in ML supply-chain tooling to vet PyTorch model files before they are deserialized. Its scan_pytorch path calls get_magic_number(), which iterates pickle opcodes via pickletools.genops() and only treats values whose opcode name contains INT or LONG as the magic number. PyTorch's own _legacy_save / serialization.py instead executes the pickle stream through pickle_module.load(), which honors REDUCE opcodes and therefore evaluates a (eval, ('MAGIC_NUMBER',)) reducer at load time to recover the same integer. This semantic gap between a static opcode walker and a real pickle VM is the textbook root cause behind CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code / 'Eval Injection'): the scanner's model of the file diverges from the consumer's model, and the malicious __reduce__ that smuggles code execution rides through on the same parser-differential.
RemediationAI
Vendor-released patch: upgrade picklescan to 1.0.3 or later (pip install --upgrade 'picklescan>=1.0.3'); the fix lands in commits 2a8383cfeb4158567f9770d86597300c9e508d0f and 134179474539648ba7dee1317959529fbd0e7f89 referenced from GHSA-97f8-7cmv-76j2. Until the upgrade is rolled out everywhere that ingests model files, stop relying on picklescan as a sole 'safe to load' signal and load PyTorch checkpoints with torch.load(..., weights_only=True) - this restricts deserialization to safe tensor primitives and blocks the __reduce__/eval gadget entirely, at the cost of breaking models that legitimately serialize Python objects (custom classes, lambdas, optimizer states with arbitrary callables). For pipelines that must accept full pickle models, sandbox the load in a network- and filesystem-restricted process (seccomp, gVisor, or a disposable container), and reject any pickle that contains REDUCE/GLOBAL opcodes referencing eval, exec, os.system, subprocess, or __import__ as a complementary scanner rule. Restrict accepted model sources to a signed/internal registry rather than ad-hoc Hugging Face downloads to reduce attacker reachability.
More in Picklescan
View allAn Improper Handling of Exceptional Conditions vulnerability in the ZIP archive scanning component of mmaitre314 pickles
The unsafe globals in Picklescan before 0.0.25 do not include ssl. Rated medium severity (CVSS 6.8), this vulnerability
picklescan before 0.0.21 does not treat 'pip' as an unsafe global. Rated medium severity (CVSS 5.3), this vulnerability
Remote code execution against users of picklescan versions prior to 1.0.4 is achievable by smuggling any blocked functio
Arbitrary code execution in picklescan versions prior to 1.0.1 allows attackers to bypass the scanner's malicious pickle
picklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. Rated m
Remote code execution in picklescan versions prior to 1.0.4 allows attackers to bypass the scanner's safety validation b
Arbitrary code execution bypass in picklescan before 1.0.4 allows attackers to smuggle malicious pickle files past the s
Detection bypass in picklescan versions prior to 0.0.27 allows attackers to smuggle malicious Python pickle files past t
Remote code execution in picklescan before 0.0.33 enables attackers to bypass the tool's malicious-pickle detection by s
Arbitrary file write in picklescan before 0.0.33 lets attackers bypass the tool's dangerous-call blocklist by abusing di
Arbitrary code execution in picklescan before 0.0.33 allows remote attackers to bypass the scanner's malicious-pickle de
Same weakness CWE-95 – Eval Injection
View allShare
External POC / Exploit Code
Leaving vuln.today