Executive brief
Picklescan is a widely-used library that organizations rely on to scan pickle files (a Python serialization format) for malicious code before loading them into machine learning models and data processing pipelines. This vulnerability allows attackers to bypass Picklescan's safety checks by exploiting a detection gap: the library fails to flag dangerous code hidden within calls to Python's built-in cProfile.runctx function. An attacker distributing infected pickle files through model repositories or APIs could execute arbitrary commands on systems that trust Picklescan to validate the files, potentially compromising sensitive data, disrupting operations, or establishing persistent access.
Technical details
The vulnerability is a deserialization bypass (CWE-502) in Picklescan's detection logic. An attacker crafts a malicious pickle file using the __reduce__ method to return cProfile.runctx as a callable with a command string argument. While cProfile.runctx is a legitimate Python standard library function designed for performance profiling, it ultimately executes arbitrary Python code via exec(), making it a gadget for remote code execution. Picklescan versions prior to 0.0.30 do not flag cProfile.runctx in their dangerous-function detection lists, so the malicious pickle file passes validation. When a user calls pickle.load() on the file after clearance from Picklescan, the __reduce__ method triggers, invoking cProfile.runctx with the attacker's payload, resulting in code execution. The attack requires only that the victim use pickle.load() on an untrusted file after scanning it with vulnerable Picklescan versions; no authentication or additional user interaction is required. The fix in version 0.0.30 adds cProfile.runctx to the detection blocklist.
Affected products
- mmaitre314 picklescan < 0.0.30
Timeline
- 2025-08-26: disclosed: GitHub advisory GHSA-9w88-8rmg-7g2p published
- 2025-08-26: patched: Picklescan version 0.0.30 released with fix