Executive brief
PickleScan is a security tool used to scan Python pickle files for malicious code, commonly used in machine learning pipelines and platforms like HuggingFace. A vulnerability was discovered that allows attackers to bypass the tool's security checks entirely by using a specific Python function to hide malicious commands. This could allow an attacker to execute unauthorized code on systems that rely on PickleScan for safety validation, potentially leading to full system compromise.
Technical details
PickleScan versions prior to 1.0.4 are vulnerable to a universal blocklist bypass due to the omission of 'pkgutil.resolve_name' from its unsafe globals list. An attacker can craft a malicious pickle file that uses 'pkgutil.resolve_name' via a REDUCE opcode to dynamically resolve and return references to blocked functions like 'os.system' or 'builtins.exec'. Because PickleScan's scanner only inspects top-level global references and not the arguments or results of REDUCE operations, it fails to detect the subsequent execution of the resolved dangerous function. This allows for arbitrary remote code execution (RCE) on any system scanning and then loading the malicious pickle. The issue is resolved in version 1.0.4 by adding pkgutil to the blocklist.
Affected products
- mmaitre314 picklescan < 1.0.4
Timeline
- 2026-03-02: advisory: Original GHSA-vvpj-8cmc-gx39 published by maintainer
- 2026-06-17: disclosed: CVE-2026-3490 published
- 2026-06-18: patched: Duplicate advisory GHSA-82fg-2r99-h7v6 withdrawn in favor of original