Executive brief
Picklescan, a tool used to scan Python pickle and PyTorch model files for malicious code, is vulnerable to a bypass that allows arbitrary code execution. An attacker can craft a malicious file that Picklescan incorrectly identifies as safe, but which executes commands when opened by a user. This could lead to full system compromise or supply-chain attacks where malicious AI models are distributed as "verified" safe.
Technical details
Picklescan fails to detect a malicious pickle gadget utilizing `numpy.f2py.crackfortran._eval_length` within the `__reduce__` method. This function can be used to execute arbitrary Python code when a pickle file is loaded via `pickle.load()`. Because Picklescan's security scanner does not flag this specific function as dangerous, it reports malicious files as safe, enabling remote code execution on systems that rely on Picklescan to vet untrusted artifacts. The vulnerability is addressed in version 0.0.33.
Affected products
- mmaitre314 picklescan < 0.0.33
Timeline
- 2025-12-27: patched: Version 0.0.33 released
- 2025-12-30: disclosed: GHSA advisory published