Executive brief
picklescan is a security tool used to scan Python pickle files for malicious code. A flaw in its detection logic allows specially crafted files to bypass security checks by using unblocked functions. If a user or automated system processes one of these malicious files, an attacker could gain full control over the affected computer.
Technical details
picklescan versions prior to 0.0.33 suffer from an incomplete list of disallowed inputs (CWE-184) within its security scanning logic. The tool fails to block the 'pydoc.locate' and 'operator.methodcaller' functions, which can be leveraged to dynamically resolve modules and execute arbitrary methods. An attacker can exploit this by crafting a malicious pickle file that uses these functions to bypass the scanner's "Dangerous" classification. When the resulting file is deserialized by a victim, it leads to arbitrary code execution. This vulnerability is addressed in version 0.0.33 by expanding the deny-list to block these modules entirely.
Affected products
- picklescan picklescan < 0.0.33
Timeline
- 2025-12-26: advisory: GitHub Security Advisory published
- 2026-06-17: disclosed: NVD publication and CVE assignment