Executive brief
Picklescan is a Python library used to scan pickle files for malicious code before loading them—a critical safeguard in machine learning workflows that use serialized models. An attacker can embed code that bypasses Picklescan's detection by using Python's built-in idlelib.pyshell.ModifiedInterpreter.runcommand function, allowing remote code execution when the pickle is loaded. This vulnerability threatens supply chain security in ML model distribution and data serialization.
Technical details
This is a deserialization vulnerability (CWE-502) in which Picklescan fails to detect a specific unsafe callable used in a pickle's __reduce__ method. The attack leverages idlelib.pyshell.ModifiedInterpreter.runcommand—a standard Python library function—to execute arbitrary code passed as a string argument. When a victim loads a malicious pickle after scanning it with Picklescan, the __reduce__ method is invoked during unpickling, calling ModifiedInterpreter.runcommand with attacker-controlled payload. The vulnerable versions (before 0.0.30) do not blacklist or detect this particular code execution path. The attack requires no authentication or special privileges; the victim only needs to call pickle.load() after checking the file with the vulnerable Picklescan library. Patch available in version 0.0.30.
Affected products
- mmaitre314 picklescan < 0.0.30
Timeline
- 2025-08-26: disclosed: Vulnerability published as GHSA-j343-8v2j-ff7w
- 2025-08-26: patched: Fix released in version 0.0.30