Executive brief
Picklescan is a security tool designed to scan Python pickle files for malicious code. A vulnerability was discovered where the tool fails to block certain Python modules, allowing a specially crafted file to bypass security checks and overwrite critical system files. This could allow an attacker to gain remote control of a system or cause a service outage by corrupting configuration files.
Technical details
A deserialization vulnerability (CWE-502) exists in picklescan versions prior to 0.0.33. While the tool maintains a blocklist of dangerous functions like open() and shutil to prevent file manipulation, it failed to include the distutils module. An attacker can exploit this by crafting a malicious pickle object that utilizes distutils.file_util.write_file. When scanned or processed, this bypasses the security filters, enabling arbitrary file writes. This can lead to remote code execution (RCE) by overwriting sensitive files such as SSH authorized_keys or application configurations. The issue is resolved in version 0.0.33 by adding distutils to the blocklist.
Affected products
- picklescan picklescan < 0.0.33
Timeline
- 2025-12-26: advisory: GitHub Security Advisory published
- 2026-06-17: disclosed: NVD publication and CVE assignment