Executive brief
Picklescan is a Python security library designed to scan pickle files for malicious code before they are loaded into applications. This vulnerability allows attackers to bypass Picklescan's detection by using the timeit.timeit() function to execute arbitrary system commands during pickle deserialization. Organizations using Picklescan to validate machine learning models, saved Python objects, or APIs could unknowingly load compromised files that execute attacker-controlled code, enabling data theft, system compromise, or supply chain attacks.
Technical details
This is an incomplete blacklist vulnerability (CWE-184) in Picklescan's unsafe globals detection. Picklescan uses a blacklist of dangerous functions to detect malicious pickle payloads during deserialization via the reduce protocol. The vulnerability exploits the fact that timeit.timeit() is a built-in Python library function not present in the blacklist. An attacker crafts a pickle file with a __reduce__ method that calls timeit.timeit() with a malicious code string as an argument. When the victim scans the file with Picklescan, it reports no dangerous globals detected. Upon calling pickle.load() on the file, timeit.timeit() executes the attacker's code string, which can import os and call os.system() to run arbitrary OS commands. No authentication or user interaction beyond loading the pickle is required; the attack is triggered purely by unpickling. Picklescan 0.0.25 and later patches this by adding timeit to the unsafe globals blacklist.
Affected products
- mmaitre314 picklescan < 0.0.25
Timeline
- 2025-04-07: disclosed
- 2025-04-07: patched: Picklescan 0.0.25 released with timeit added to unsafe globals blacklist