Executive brief
picklescan is a security tool used to scan Python pickle files and machine learning models for malicious code. A vulnerability in versions prior to 0.0.29 allows specially crafted malicious files to bypass detection by using a specific Python internal function. If a user trusts the scan results and opens the file, an attacker could execute arbitrary commands on the user's system, potentially leading to a full system compromise or data theft.
Technical details
A deserialization bypass exists in picklescan before version 0.0.29. The scanner's logic fails to identify the 'idlelib.autocomplete.AutoComplete.fetch_completions' function as dangerous when used within a pickle's __reduce__ method. An attacker can craft a malicious pickle file that, when scanned, appears safe but executes arbitrary system commands via the 'os.system' or similar calls when subsequently loaded using 'pickle.load()'. This vulnerability is categorized as CWE-502 (Deserialization of Untrusted Data). Users are advised to upgrade to version 0.0.29 or later to ensure these payloads are correctly flagged.
Affected products
- mmaitre314 picklescan < 0.0.29
Timeline
- 2025-08-26: advisory: GitHub Security Advisory GHSA-7cq8-mj8x-j263 published
- 2026-06-23: disclosed: CVE-2025-71376 published to NVD