# PickleScan blocklist bypass via pkgutil.resolve_name

Source: https://junglewise.ai/threats/picklescan-blocklist-bypass-via-pkgutil-resolve-name-74c87206  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-17. Updated: 2026-06-18  
License: CC BY 4.0 with a link back

Severity: critical · CVSS 10 · Published 2026-06-17

PickleScan is a security tool used to scan Python pickle files for malicious code, commonly used in machine learning pipelines and platforms like HuggingFace. A vulnerability was discovered that allows attackers to bypass the tool's security checks entirely by using a specific Python function to hide malicious commands. This could allow an attacker to execute unauthorized code on systems that rely on PickleScan for safety validation, potentially leading to full system compromise.

Technologies: [picklescan (PyPI)](https://junglewise.ai/threats/technologies/picklescan). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Critical severity, with a CVSS score of 10, published 17 June 2026.

**Which products and versions are affected?** picklescan (PyPI) < 1.0.4.

**Is there a fix for This vulnerability?** A patch was published on 2026-06-18: Duplicate advisory GHSA-82fg-2r99-h7v6 withdrawn in favor of original Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run picklescan (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

PickleScan versions prior to 1.0.4 are vulnerable to a universal blocklist bypass due to the omission of 'pkgutil.resolve_name' from its unsafe globals list. An attacker can craft a malicious pickle file that uses 'pkgutil.resolve_name' via a REDUCE opcode to dynamically resolve and return references to blocked functions like 'os.system' or 'builtins.exec'. Because PickleScan's scanner only inspects top-level global references and not the arguments or results of REDUCE operations, it fails to detect the subsequent execution of the resolved dangerous function. This allows for arbitrary remote code execution (RCE) on any system scanning and then loading the malicious pickle. The issue is resolved in version 1.0.4 by adding pkgutil to the blocklist.

## Affected products

- mmaitre314 picklescan < 1.0.4

## Timeline

- 2026-03-02: advisory: Original GHSA-vvpj-8cmc-gx39 published by maintainer
- 2026-06-17: disclosed: CVE-2026-3490 published
- 2026-06-18: patched: Duplicate advisory GHSA-82fg-2r99-h7v6 withdrawn in favor of original

## References

- [https://github.com/mmaitre314/picklescan/security/advisories/GHSA-vvpj-8cmc-gx39](https://github.com/mmaitre314/picklescan/security/advisories/GHSA-vvpj-8cmc-gx39)
- [https://www.vulncheck.com/advisories/picklescan-universal-blocklist-bypass-via-pkgutil-resolve-name](https://www.vulncheck.com/advisories/picklescan-universal-blocklist-bypass-via-pkgutil-resolve-name)

## Related threats

- [picklescan detection bypass via _operator.methodcaller](https://junglewise.ai/threats/cve-2025-71375-picklescan-detection-bypass-via-operator-methodcaller)
- [picklescan security bypass via operator.methodcaller](https://junglewise.ai/threats/cve-2025-71373-picklescan-security-bypass-via-operator-methodcaller)
- [Picklescan detection bypass via numpy getlincoef gadget](https://junglewise.ai/threats/cve-2025-71372-picklescan-detection-bypass-via-numpy-getlincoef-gadget)
- [picklescan safety check bypass via PyTorch decoder basichandlers](https://junglewise.ai/threats/cve-2025-71369-picklescan-safety-check-bypass-via-pytorch-decoder-basichandlers)
- [picklescan security bypass via _operator.attrgetter function call](https://junglewise.ai/threats/cve-2025-71367-picklescan-security-bypass-via-operator-attrgetter-function-call)