EUVD-2026-38123
GHSA-hqgf-f82p-fjh7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no auth or interaction (AV:N/PR:N/UI:N); impact limited to file creation (I:L) and lock-file DoS (A:L); no confidentiality impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
picklescan before 1.0.1 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to create arbitrary zero-byte files via logging.FileHandler class instantiation. Attackers can exploit this by crafting malicious pickle payloads to bypass RCE blocklists and create lock files or other filesystem artifacts, potentially causing denial of service or application disruption.
AnalysisAI
Unsafe pickle deserialization in picklescan before 1.0.1 allows unauthenticated remote attackers to create arbitrary zero-byte files on the server by crafting malicious pickle payloads that instantiate Python's standard-library logging.FileHandler class. This technique bypasses RCE-focused blocklists because it abuses legitimate standard library functionality rather than commonly blocked modules, making it a notable blocklist-evasion primitive. A publicly available proof-of-concept exploit exists; no public exploit identified at time of analysis for active KEV-confirmed exploitation, but the PoC demonstrates concrete filesystem impact including lock-file-based denial of service.
Technical ContextAI
picklescan (cpe:2.3:a:picklescan:picklescan:*:*:*:*:*:*:*:*) is a Python security tool designed to detect malicious pickle files by scanning for dangerous opcodes and blocked class references. The irony of this vulnerability is that the scanner itself is vulnerable to the attack class it is meant to detect. CWE-502 (Deserialization of Untrusted Data) is the root cause: when picklescan processes a pickle file, it deserializes content before or during its analysis phase, allowing untrusted pickle opcodes to execute. The exploit chain leverages Python's pickle REDUCE opcode to instantiate logging.FileHandler - a standard library class that opens or creates a file upon construction. Because FileHandler is not a typical RCE-associated class (no exec, subprocess, os.system references), it evades keyword-based blocklists. On non-existent paths it creates a zero-byte file; on existing paths it opens in append mode without modifying content, limiting impact to file creation only.
RemediationAI
Upgrade picklescan to version 1.0.1 immediately; this is the vendor-confirmed fixed version per the GHSA advisory (https://github.com/mmaitre314/picklescan/security/advisories/GHSA-m7j5-r2p5-c39r) and the upstream fix is available via commit 4d9bc9cd34bca8672dad3481cd4556d5ba747156 and pull request https://github.com/mmaitre314/picklescan/pull/60. Run 'pip install --upgrade picklescan>=1.0.1' to remediate. If an immediate upgrade is not possible, the most effective compensating control is to avoid deserializing untrusted pickle files using the vulnerable picklescan version directly; instead, sandbox the scanning process inside a container or VM with a read-only filesystem or a strict seccomp/AppArmor profile that blocks open() system calls for write access - this prevents new file creation even if the payload executes. As an additional control, monitor for unexpected zero-byte file creation in application directories, particularly files matching common lock patterns (*.lock, maintenance.*). Note that restricting network-level access to the scanning service is not a viable workaround if the service is designed to accept externally submitted files.
More in Picklescan
View allAn Improper Handling of Exceptional Conditions vulnerability in the ZIP archive scanning component of mmaitre314 pickles
A Protection Mechanism Failure vulnerability in mmaitre314 picklescan versions up to and including 0.0.30 allows a remot
An Improper Input Validation vulnerability in the scanning logic of mmaitre314 picklescan versions up to and including 0
Detection bypass in picklescan prior to 0.0.29 allows attackers to smuggle remote code execution payloads through pickle
Detection bypass in picklescan versions before 0.0.25 allows attackers to embed remote code execution payloads in pickle
Detection bypass in picklescan before 0.0.28 allows attackers to embed malicious torch.jit.unsupported_tensor_ops.execWr
Detection bypass in picklescan before 0.0.28 allows attackers to smuggle arbitrary code through pickle files by abusing
Detection bypass in picklescan before 0.0.29 allows malicious pickle files to evade scanning by abusing the undetected i
Detection bypass in picklescan versions before 0.0.30 allows malicious pickle files to evade security scanning by using
Detection bypass in picklescan versions prior to 0.0.29 allows attackers to smuggle arbitrary code execution payloads th
Detection bypass in picklescan before 0.0.33 allows attackers to smuggle arbitrary code through malicious pickle files b
Detection bypass in picklescan before 0.0.29 allows attackers to craft malicious pickle files using idlelib.debugobj.Obj
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today