Executive brief
picklescan is a security tool used to scan Python pickle files for malicious code. A flaw in its protection mechanism allows specially crafted files to bypass security checks and execute unauthorized commands on the system. This could lead to a complete system takeover or data theft while the tool incorrectly reports that the file is safe.
Technical details
picklescan versions prior to 1.0.4 suffer from an incomplete blocklist (CWE-184) regarding the Python 'profile' module. While the scanner attempted to block 'Profile.run' and 'Profile.runctx', it failed to account for the module-level 'profile.run()' and 'profile.runctx()' functions due to exact string matching logic in the opcode parser. An attacker can craft a malicious pickle file that calls these module-level functions to execute arbitrary Python code via the internal 'exec()' call. Because the scanner fails to flag these specific entry points, it reports zero security issues for a payload that results in Remote Code Execution (RCE). The issue is resolved in version 1.0.4 by expanding the blocklist.
Affected products
- picklescan picklescan < 1.0.4
Timeline
- 2026-03-02: advisory: GitHub Security Advisory GHSA-7wx9-6375-f5wh published
- 2026-06-17: disclosed: CVE-2026-53873 published to NVD