# CVE-2026-56315: picklescan remote code execution via unblocked standard library modules

Source: https://junglewise.ai/threats/cve-2026-56315-picklescan-remote-code-execution-via-unblocked-standard-library  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-23. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2026-56315 · Severity: critical · CVSS 9.8 · Published 2026-06-23

picklescan is a security tool used to scan Python "pickle" files for malicious code, commonly used by platforms like HuggingFace to protect users from dangerous machine learning models. A vulnerability was discovered where the tool fails to block several dangerous Python modules, allowing specially crafted malicious files to bypass security checks entirely. If an attacker uploads such a file and a user or system opens it, the attacker can gain full control over the target computer, leading to data theft or system compromise.

Technologies: [picklescan (PyPI)](https://junglewise.ai/threats/technologies/picklescan). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-56315 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56315 being exploited in the wild.

**How severe is CVE-2026-56315?** Critical severity, with a CVSS score of 9.8, published 23 June 2026.

**Which products and versions are affected?** picklescan (PyPI) < 1.0.4, ECOSYSTEM:introduced=0,fixed=1.0.4.

**Is there a fix for CVE-2026-56315?** Yes. picklescan (PyPI): upgrade to 1.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56315 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-56315?** Check whether you run picklescan (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- picklescan (PyPI): upgrade to 1.0.4 or later

  ```sh
  pip install "picklescan>=1.0.4"
  ```


## Technical details

picklescan (versions prior to 1.0.4) contains a protection mechanism failure (CWE-184) in its blocklist-based security scanner. The `_unsafe_globals` list fails to include at least seven Python standard library modules—including uuid, _osx_support, _aix_support, _pyrepl.pager, and imaplib—which contain functions capable of executing arbitrary system commands. An attacker can craft a malicious pickle file that imports these unblocked modules; when scanned, picklescan reports the file as 'CLEAN', but upon loading the file via `pickle.loads()`, the attacker achieves arbitrary code execution. This bypasses the primary security utility of the tool in environments like HuggingFace Hub and ML CI/CD pipelines. The issue is addressed in version 1.0.4 by expanding the blocklist.

## Affected products

- picklescan picklescan < 1.0.4

## Identifiers

- CVE-2026-56315
- GHSA-g38g-8gr9-h9xp
- PYSEC-2026-4134

## Timeline

- 2026-03-02: advisory: GitHub Security Advisory GHSA-g38g-8gr9-h9xp published
- 2026-06-23: disclosed: CVE-2026-56315 published to NVD
- 2026-06-23: patched: Version 1.0.4 released to address the blocklist omissions

## References

- [https://github.com/mmaitre314/picklescan/security/advisories/GHSA-g38g-8gr9-h9xp](https://github.com/mmaitre314/picklescan/security/advisories/GHSA-g38g-8gr9-h9xp)
- [https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-unblocked-standard-library-modules](https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-unblocked-standard-library-modules)

## Related threats

- [picklescan detection bypass via _operator.methodcaller](https://junglewise.ai/threats/cve-2025-71375-picklescan-detection-bypass-via-operator-methodcaller)
- [picklescan security bypass via operator.methodcaller](https://junglewise.ai/threats/cve-2025-71373-picklescan-security-bypass-via-operator-methodcaller)
- [Picklescan detection bypass via numpy getlincoef gadget](https://junglewise.ai/threats/cve-2025-71372-picklescan-detection-bypass-via-numpy-getlincoef-gadget)
- [picklescan safety check bypass via PyTorch decoder basichandlers](https://junglewise.ai/threats/cve-2025-71369-picklescan-safety-check-bypass-via-pytorch-decoder-basichandlers)
- [picklescan security bypass via _operator.attrgetter function call](https://junglewise.ai/threats/cve-2025-71367-picklescan-security-bypass-via-operator-attrgetter-function-call)