EUVD-2026-38123
GHSA-hqgf-f82p-fjh7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no auth or interaction (AV:N/PR:N/UI:N); impact limited to file creation (I:L) and lock-file DoS (A:L); no confidentiality impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
picklescan before 1.0.1 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to create arbitrary zero-byte files via logging.FileHandler class instantiation. Attackers can exploit this by crafting malicious pickle payloads to bypass RCE blocklists and create lock files or other filesystem artifacts, potentially causing denial of service or application disruption.
AnalysisAI
Unsafe pickle deserialization in picklescan before 1.0.1 allows unauthenticated remote attackers to create arbitrary zero-byte files on the server by crafting malicious pickle payloads that instantiate Python's standard-library logging.FileHandler class. This technique bypasses RCE-focused blocklists because it abuses legitimate standard library functionality rather than commonly blocked modules, making it a notable blocklist-evasion primitive. A publicly available proof-of-concept exploit exists; no public exploit identified at time of analysis for active KEV-confirmed exploitation, but the PoC demonstrates concrete filesystem impact including lock-file-based denial of service.
Technical ContextAI
picklescan (cpe:2.3:a:picklescan:picklescan:*:*:*:*:*:*:*:*) is a Python security tool designed to detect malicious pickle files by scanning for dangerous opcodes and blocked class references. The irony of this vulnerability is that the scanner itself is vulnerable to the attack class it is meant to detect. CWE-502 (Deserialization of Untrusted Data) is the root cause: when picklescan processes a pickle file, it deserializes content before or during its analysis phase, allowing untrusted pickle opcodes to execute. The exploit chain leverages Python's pickle REDUCE opcode to instantiate logging.FileHandler - a standard library class that opens or creates a file upon construction. Because FileHandler is not a typical RCE-associated class (no exec, subprocess, os.system references), it evades keyword-based blocklists. On non-existent paths it creates a zero-byte file; on existing paths it opens in append mode without modifying content, limiting impact to file creation only.
RemediationAI
Upgrade picklescan to version 1.0.1 immediately; this is the vendor-confirmed fixed version per the GHSA advisory (https://github.com/mmaitre314/picklescan/security/advisories/GHSA-m7j5-r2p5-c39r) and the upstream fix is available via commit 4d9bc9cd34bca8672dad3481cd4556d5ba747156 and pull request https://github.com/mmaitre314/picklescan/pull/60. Run 'pip install --upgrade picklescan>=1.0.1' to remediate. If an immediate upgrade is not possible, the most effective compensating control is to avoid deserializing untrusted pickle files using the vulnerable picklescan version directly; instead, sandbox the scanning process inside a container or VM with a read-only filesystem or a strict seccomp/AppArmor profile that blocks open() system calls for write access - this prevents new file creation even if the payload executes. As an additional control, monitor for unexpected zero-byte file creation in application directories, particularly files matching common lock patterns (*.lock, maintenance.*). Note that restricting network-level access to the scanning service is not a viable workaround if the service is designed to accept externally submitted files.
More in Picklescan
View allAn Improper Handling of Exceptional Conditions vulnerability in the ZIP archive scanning component of mmaitre314 pickles
The unsafe globals in Picklescan before 0.0.25 do not include ssl. Rated medium severity (CVSS 6.8), this vulnerability
picklescan before 0.0.21 does not treat 'pip' as an unsafe global. Rated medium severity (CVSS 5.3), this vulnerability
Remote code execution against users of picklescan versions prior to 1.0.4 is achievable by smuggling any blocked functio
Arbitrary code execution in picklescan versions prior to 1.0.1 allows attackers to bypass the scanner's malicious pickle
picklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. Rated m
Remote code execution in picklescan versions prior to 1.0.4 allows attackers to bypass the scanner's safety validation b
Arbitrary code execution bypass in picklescan before 1.0.4 allows attackers to smuggle malicious pickle files past the s
Detection bypass in picklescan versions prior to 0.0.27 allows attackers to smuggle malicious Python pickle files past t
Remote code execution in picklescan before 0.0.33 enables attackers to bypass the tool's malicious-pickle detection by s
Arbitrary file write in picklescan before 0.0.33 lets attackers bypass the tool's dangerous-call blocklist by abusing di
Arbitrary code execution in picklescan before 0.0.33 allows remote attackers to bypass the scanner's malicious-pickle de
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today