Executive brief
picklescan is a security tool used to scan Python pickle files and Machine Learning models for malicious code. A vulnerability in versions before 0.0.28 allows specially crafted malicious files to bypass these safety checks by using specific PyTorch functions. If a user trusts the scan result and opens the file, an attacker could gain full control over the victim's system through remote code execution.
Technical details
A deserialization vulnerability (CWE-502) exists in picklescan due to an incomplete blocklist of dangerous functions. Specifically, the scanner fails to identify the use of 'torch.utils.data.datapipes.utils.decoder.basichandlers' within a pickle object's '__reduce__' method. An attacker can wrap a secondary malicious payload within this PyTorch handler, which picklescan ignores during its safety audit. When a victim subsequently loads the 'verified' file using 'pickle.load()', the handler executes the embedded payload. This bypass enables remote code execution (RCE) on the host machine. The issue is resolved in version 0.0.28.
Affected products
- picklescan picklescan < 0.0.28
Timeline
- 2025-08-22: advisory: Initial GitHub security advisory published
- 2026-07-04: disclosed: NVD publication date