Executive brief
picklescan is a security tool used to scan Python pickle files and machine learning models for malicious code. A vulnerability in versions before 0.0.30 allows specially crafted malicious files to bypass detection by using a specific Python function. If a user trusts the scan results and opens the file, an attacker can execute arbitrary commands on the user's system, potentially leading to a full system compromise.
Technical details
A deserialization vulnerability (CWE-502) exists in picklescan due to an incomplete blocklist of dangerous functions. The tool fails to identify the 'doctest.debug_script' function when analyzing pickle files. An attacker can craft a malicious pickle file using the '__reduce__' method to call this function, which internally executes arbitrary Python code via 'exec()'. If a victim relies on picklescan to validate a file and subsequently loads it using 'pickle.load()', the embedded payload will execute. This issue is resolved in version 0.0.30.
Affected products
- picklescan picklescan < 0.0.30
Timeline
- 2025-08-26: advisory: Initial GitHub security advisory published
- 2026-06-30: disclosed: CVE published to NVD