Executive brief
PickleScan is a security tool used to scan Python pickle files and AI models (like PyTorch) for malicious code. A vulnerability exists where the tool fails to recognize certain dangerous commands, allowing attackers to hide malicious code inside files that the scanner incorrectly marks as safe. If a user or automated system then runs or loads these "cleared" files, an attacker could take full control of the system.
Technical details
PickleScan (versions prior to 0.0.33) suffers from a protection mechanism failure (CWE-693) due to an incomplete blocklist of unsafe Python globals. Specifically, the 'pty.spawn' function was omitted from the list of dangerous functions, causing the scanner to categorize it as merely 'suspicious' rather than 'dangerous'. An attacker can exploit this by crafting a malicious pickle payload—often embedded in PyTorch models or ZIP archives—that utilizes pty.spawn to execute arbitrary shell commands. When a user processes the malicious file with PickleScan, the security check is bypassed, potentially leading to code execution upon subsequent loading of the file. The issue is resolved in version 0.0.33 by adding 'pty: spawn' to the _unsafe_globals list.
Affected products
- PickleScan PickleScan < 0.0.33
Timeline
- 2025-12-26: advisory: GitHub Security Advisory published
- 2026-06-17: disclosed: NVD publication date