Executive brief
picklescan is a security tool used to scan Python pickle files and machine learning models for malicious code. A vulnerability exists where the tool fails to detect certain dangerous commands hidden within these files. If a user relies on an affected version of picklescan to verify a file and then opens it, an attacker could gain full control over the user's system.
Technical details
A deserialization vulnerability (CWE-502) exists in picklescan versions prior to 0.0.28. The scanner's blocklist/allowlist logic fails to identify the 'torch.utils.bottleneck.__main__.run_cprofile' function as a dangerous global. An attacker can craft a malicious pickle file using this function in a '__reduce__' method to execute arbitrary Python code. When a victim scans the file, picklescan reports it as safe; subsequent loading of the file via 'pickle.load()' results in arbitrary code execution. This issue is resolved in version 0.0.28.
Affected products
- picklescan picklescan < 0.0.28
Timeline
- 2025-08-22: advisory: GitHub Security Advisory published
- 2026-07-03: disclosed: CVE published to NVD