Which versions of picklescan are affected by CVE-2026-56315?

picklescan, a Python security tool relied upon by HuggingFace Hub and machine learning pipelines to validate untrusted pickle files, contains a critical remote code execution vulnerability (CVSS 9.3)…. A patch is available.

How to fix or mitigate CVE-2026-56315?

24 hours: Inventory all systems running picklescan versions prior to 1.0.4 (particularly HuggingFace Hub instances, ML training environments, automated model pipelines); immediately restrict pickle file ingestion from untrusted external sources and enable process isolation. 7 days: Evaluate alternative pickle validation approaches or safer serialization formats (JSON, Protocol Buffers, safetensors for ML models); test compatibility with existing workflows. 30 days: Complete migration from picklescan to validated alternative serialization or decommission pickle-based processing entirely.

picklescan CVE-2026-56315

Q: What is the CVSS score of CVE-2026-56315?

CVE-2026-56315 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

EUVD-2026-38437 CRITICAL

Incomplete List of Disallowed Inputs (CWE-184)

2026-06-23 VulnCheck

GHSA-g7vj-qw6x-g3p8

RCE Python Picklescan

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Malicious pickle delivered over the network bypasses scanner without auth or interaction and yields full code execution on the loader, so PR:N/UI:N and C/I/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 23, 2026 - 14:17 EUVD

Source Code Evidence Fetched

Jun 23, 2026 - 13:05 vuln.today

Analysis Generated

Jun 23, 2026 - 13:05 vuln.today

DescriptionCVE.org

picklescan before 1.0.4 fails to block at least seven Python standard library modules (including uuid, _osx_support, _aix_support, _pyrepl.pager, and imaplib) exposing eight functions that provide direct arbitrary command execution. Attackers can craft malicious pickle files importing these unblocked modules to achieve remote code execution while bypassing picklescan's safety validation entirely.

Articles & Coverage 1

News Critical RCE in Python picklescan via Blocklist Bypass - CVE-2026-56315 Jun 23, 2026

AnalysisAI

Remote code execution in picklescan versions prior to 1.0.4 allows attackers to bypass the scanner's safety validation by crafting malicious pickle files that import unblocked Python standard library modules. The tool's blocklist (scanner.py _unsafe_globals) omits at least seven stdlib modules - including uuid, _osx_support, _aix_support, _pyrepl.pager, and imaplib - exposing eight functions that execute arbitrary commands via subprocess or os.system. Publicly available exploit code exists in the GHSA advisory, demonstrating CLEAN scan results for files that achieve full RCE on load; this is especially concerning because picklescan is relied on by HuggingFace Hub and similar ML pipelines.

Technical ContextAI

picklescan is a Python utility that statically inspects pickle files for dangerous global imports before deserialization, maintaining an allow/deny list of (module, attribute) pairs in scanner.py. The vulnerability is a classic CWE-184 (Incomplete List of Disallowed Inputs) flaw: the _unsafe_globals dictionary enumerates only ~60 known-dangerous entries and omits several stdlib helpers that themselves wrap subprocess.Popen, os.system, or shell=True invocations. Because pickle's reduce protocol can call any importable callable, an attacker only needs one omitted module-function pair (e.g., uuid._get_command_stdout, imaplib.IMAP4_stream, _pyrepl.pager.pipe_pager) to achieve code execution while the scanner reports zero issues. CPE cpe:2.3:a:picklescan:picklescan:*:*:*:*:*:*:*:* identifies the affected package across all versions ≤ 1.0.3.

RemediationAI

Vendor-released patch: upgrade picklescan to 1.0.4 or later via pip (pip install --upgrade picklescan>=1.0.4), which extends the _unsafe_globals blocklist to cover the missing stdlib modules - see https://github.com/mmaitre314/picklescan/security/advisories/GHSA-g38g-8gr9-h9xp for details. Until the upgrade is rolled out across all model-ingestion pipelines, treat picklescan CLEAN results as untrusted and require an additional control: load pickles only inside a sandbox with no outbound network and no shell, or convert third-party model weights to safetensors before loading to avoid pickle deserialization entirely. Operators of model registries (HuggingFace mirrors, internal ML platforms) should re-scan previously accepted pickle artifacts with 1.0.4 to catch files that passed earlier scans, accepting the trade-off of compute cost and potential false positives on legacy models.