Executive brief
picklescan is a security tool used to scan Python pickle files for malicious code. A vulnerability was discovered where the tool fails to identify the 'ctypes' module as dangerous, allowing specially crafted files to bypass security checks. An attacker could use this flaw to execute unauthorized commands or access sensitive system memory on machines where these files are processed.
Technical details
A vulnerability exists in picklescan versions prior to 0.0.33 due to an incomplete list of disallowed inputs (CWE-184). The scanner fails to flag the 'ctypes' module, which provides foreign function interface capabilities. An attacker can exploit this by crafting a malicious pickle file that uses ctypes.WinDLL to load system libraries (like kernel32.dll) and execute arbitrary commands. This bypasses the tool's sandbox protections and gadget chain detection by utilizing direct syscalls and raw memory access. The issue is resolved in version 0.0.33.
Affected products
- picklescan picklescan < 0.0.33
Timeline
- 2025-12-26: advisory: GitHub Security Advisory published
- 2026-06-17: disclosed: NVD publication date