Executive brief
Picklescan is a security tool used to scan Python pickle files and machine learning models for malicious code. A vulnerability in versions prior to 0.0.29 allows specially crafted malicious files to bypass detection by using a specific Python profiling function. If a user trusts the scan results and opens the file, an attacker could gain full control over the user's system, potentially leading to data theft or a complete system compromise.
Technical details
A deserialization vulnerability exists in picklescan versions prior to 0.0.29 due to an incomplete blocklist of dangerous functions. The scanner fails to identify the 'profile.Profile.runctx' function when it is embedded within a pickle file's '__reduce__' method. An attacker can exploit this by crafting a malicious pickle file that, when scanned, appears benign but executes arbitrary Python code upon deserialization via 'pickle.load()'. This bypasses the primary security utility of the library, facilitating remote code execution (RCE) in environments that rely on picklescan to validate untrusted models or data. The issue is addressed in version 0.0.29.
Affected products
- picklescan picklescan < 0.0.29
Timeline
- 2025-08-26: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: NVD publication date