CVE-2026-56315: picklescan remote code execution via unblocked standard library modules

CVE-2026-56315 · Severity: critical · CVSS 9.8 · Published 2026-06-23

picklescan is a security tool used to scan Python "pickle" files for malicious code, commonly used by platforms like HuggingFace to protect users from dangerous machine learning models. A vulnerability was discovered where the tool fails to block several dangerous Python modules, allowing specially crafted malicious files to bypass security checks entirely. If an attacker uploads such a file and a user or system opens it, the attacker can gain full control over the target computer, leading to data theft or system compromise.

Technologies: picklescan (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-56315 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-56315 being exploited in the wild.
How severe is CVE-2026-56315?
Critical severity, with a CVSS score of 9.8, published 23 June 2026.
Which products and versions are affected?
picklescan (PyPI) < 1.0.4, ECOSYSTEM:introduced=0,fixed=1.0.4.
Is there a fix for CVE-2026-56315?
Yes. picklescan (PyPI): upgrade to 1.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56315 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-56315?
Check whether you run picklescan (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • picklescan (PyPI): upgrade to 1.0.4 or later
    pip install "picklescan>=1.0.4"

Technical details

picklescan (versions prior to 1.0.4) contains a protection mechanism failure (CWE-184) in its blocklist-based security scanner. The `_unsafe_globals` list fails to include at least seven Python standard library modules—including uuid, _osx_support, _aix_support, _pyrepl.pager, and imaplib—which contain functions capable of executing arbitrary system commands. An attacker can craft a malicious pickle file that imports these unblocked modules; when scanned, picklescan reports the file as 'CLEAN', but upon loading the file via `pickle.loads()`, the attacker achieves arbitrary code execution. This bypasses the primary security utility of the tool in environments like HuggingFace Hub and ML CI/CD pipelines. The issue is addressed in version 1.0.4 by expanding the blocklist.

Affected products

  • picklescan picklescan < 1.0.4

Identifiers

  • CVE-2026-56315
  • GHSA-g38g-8gr9-h9xp
  • PYSEC-2026-4134

Timeline

  • 2026-03-02: advisory: GitHub Security Advisory GHSA-g38g-8gr9-h9xp published
  • 2026-06-23: disclosed: CVE-2026-56315 published to NVD
  • 2026-06-23: patched: Version 1.0.4 released to address the blocklist omissions

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.