Executive brief
picklescan is a security tool used to scan Python "pickle" files for malicious code, commonly used by platforms like HuggingFace to protect users from dangerous machine learning models. A vulnerability was discovered where the tool fails to block several dangerous Python modules, allowing specially crafted malicious files to bypass security checks entirely. If an attacker uploads such a file and a user or system opens it, the attacker can gain full control over the target computer, leading to data theft or system compromise.
Technical details
picklescan (versions prior to 1.0.4) contains a protection mechanism failure (CWE-184) in its blocklist-based security scanner. The `_unsafe_globals` list fails to include at least seven Python standard library modules—including uuid, _osx_support, _aix_support, _pyrepl.pager, and imaplib—which contain functions capable of executing arbitrary system commands. An attacker can craft a malicious pickle file that imports these unblocked modules; when scanned, picklescan reports the file as 'CLEAN', but upon loading the file via `pickle.loads()`, the attacker achieves arbitrary code execution. This bypasses the primary security utility of the tool in environments like HuggingFace Hub and ML CI/CD pipelines. The issue is addressed in version 1.0.4 by expanding the blocklist.
Affected products
- picklescan picklescan < 1.0.4
Timeline
- 2026-03-02: advisory: GitHub Security Advisory GHSA-g38g-8gr9-h9xp published
- 2026-06-23: disclosed: CVE-2026-56315 published to NVD
- 2026-06-23: patched: Version 1.0.4 released to address the blocklist omissions