Executive brief
picklescan is a security tool used to scan Python pickle files and machine learning models for malicious code. A vulnerability exists where the tool fails to detect dangerous commands hidden within the 'cProfile.run' function. If a user relies on this tool to verify a file and then opens a malicious one, an attacker could gain full control over the user's system.
Technical details
A deserialization vulnerability (CWE-502) exists in picklescan versions prior to 0.0.30. The tool's detection logic fails to identify the 'cProfile.run' built-in function when used within a pickle object's '__reduce__' method. An attacker can craft a malicious pickle file that uses 'cProfile.run' to execute arbitrary Python statements (which internally calls 'exec'). Because picklescan marks these files as safe, users may proceed to load them using 'pickle.load()', resulting in remote code execution. The issue is resolved in version 0.0.30.
Affected products
- picklescan picklescan < 0.0.30
Timeline
- 2025-08-26: advisory: Initial GitHub security advisory published
- 2026-06-30: disclosed: CVE published and NVD record created