Executive brief
picklescan is a security tool used to scan Python pickle files and machine learning models (like PyTorch) for malicious code. A vulnerability was discovered where the tool fails to detect certain dangerous commands, allowing a specially crafted file to bypass security checks. If a user or automated system trusts the scan results and opens a malicious file, an attacker could execute arbitrary code on the system, potentially leading to a full system compromise or data theft.
Technical details
A protection mechanism failure (CWE-693) exists in picklescan versions prior to 0.0.33. The library's scanning logic fails to identify and flag the 'operator.methodcaller' built-in Python function when embedded in pickle opcodes. An attacker can exploit this by manually crafting a malicious pickle payload that uses this function to trigger arbitrary system commands. Because picklescan reports the file as safe, downstream applications that rely on it for validation will proceed to load the file using 'pickle.load()', resulting in remote code execution. The vulnerability is particularly relevant for environments processing untrusted machine learning models or serialized Python objects.
Affected products
- picklescan picklescan < 0.0.33
Timeline
- 2025-12-27: advisory: GitHub Security Advisory published
- 2026-07-04: disclosed: NVD publication date