Executive brief
picklescan is a security tool used to scan Python pickle files and machine learning models for malicious code. A vulnerability in versions prior to 0.0.28 allows specially crafted malicious files to bypass detection by using a specific PyTorch function. If a user trusts the scan results and opens the file, an attacker could execute arbitrary code on the victim's system, potentially leading to a full system compromise or data theft.
Technical details
A deserialization vulnerability (CWE-502) exists in picklescan due to an incomplete blocklist of dangerous functions. Specifically, the scanner fails to identify and flag the 'torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression' function, which can be leveraged to execute arbitrary Python code during the unpickling process. An attacker can craft a malicious pickle file containing this function call in a '__reduce__' method. When a victim scans the file, picklescan reports it as safe; if the victim subsequently loads the file using 'pickle.load()', the embedded payload executes. This issue is resolved in version 0.0.28.
Affected products
- picklescan picklescan < 0.0.28
Timeline
- 2025-08-22: advisory: GitHub Security Advisory published
- 2026-07-04: disclosed: NVD publication date