Executive brief
Picklescan, a tool used to detect malicious code in machine learning models and data files, can be bypassed by simply changing a file's extension. An attacker can disguise a dangerous file using a PyTorch-related extension (like .bin), causing the scanner to skip its security checks. This could allow malicious code to be executed on a user's system when they load what they believe to be a safe, scanned model.
Technical details
A vulnerability in the `scan_bytes` function of `picklescan/scanner.py` allows attackers to bypass security scans by using mismatched file extensions. The scanner prioritizes PyTorch-specific parsing logic if a file has a PyTorch-related extension (e.g., .bin, .pt). If the file is actually a standard pickle file, the PyTorch parser fails and returns an error immediately without falling back to standard pickle analysis. This logic flaw allows malicious pickle files to bypass detection entirely. The issue is addressed in version 0.0.31 by ensuring the scanner always attempts a standard pickle scan as a fallback regardless of the file extension or initial parsing failures.
Affected products
- mmaitre314 picklescan <= 0.0.30
Timeline
- 2025-09-08: disclosed
- 2025-09-10: advisory
- 2025-09-10: patched: Version 0.0.31 released
References
- https://github.com/mmaitre314/picklescan/security/advisories/GHSA-jgw4-cr84-mqxg
- https://github.com/mmaitre314/picklescan/commit/28a7b4ef753466572bda3313737116eeb9b4e5c5
- https://github.com/mmaitre314/picklescan/blob/58983e1c20973ac42f2df7ff15d7c8cd32f9b688/src/picklescan/scanner.py
- https://github.com/pypa/advisory-database/tree/main/vulns/picklescan/PYSEC-2025-151.yaml
- https://api.github.com/repos/mmaitre314/picklescan/security-advisories/GHSA-jgw4-cr84-mqxg