Executive brief
picklescan is a security tool used to scan Python pickle files and machine learning models for malicious code. A vulnerability allows specially crafted files to bypass these security checks by using a specific internal Python function. If a user relies on picklescan to verify a file and then opens it, an attacker could execute arbitrary commands on the user's system.
Technical details
A deserialization vulnerability exists in picklescan due to an incomplete blocklist or detection logic. The tool fails to identify malicious payloads that wrap dangerous code within the 'lib2to3.pgen2.grammar.Grammar.loads' function during the pickle '__reduce__' process. An attacker can craft a malicious pickle file (often distributed as a machine learning model) that evades detection by picklescan. When a victim subsequently loads this file using 'pickle.load()', the embedded payload executes arbitrary code. This issue is resolved in version 0.0.29.
Affected products
- picklescan picklescan < 0.0.29
Timeline
- 2025-08-26: advisory: GitHub Security Advisory published
- 2026-07-04: disclosed: NVD publication date
- 2026-07-04: patched: Fix confirmed in version 0.0.29