PickleScan incomplete blocklist RCE via stdlib modules

Severity: critical · CVSS 9.8 · Published 2026-06-23

PickleScan is a Python security tool used to scan pickle files for malicious content before deserialization. The tool fails to block at least seven standard library modules (including uuid, imaplib, and _osx_support) that contain functions capable of executing arbitrary system commands. Attackers can craft pickle files that bypass PickleScan's safety checks entirely and execute arbitrary code when the files are loaded.

Technologies: picklescan (PyPI). Vendors: PyPI.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Critical severity, with a CVSS score of 9.8, published 23 June 2026.
Which products and versions are affected?
picklescan (PyPI) < 1.0.4.
Is there a fix for This vulnerability?
A patch was published on 2026-06-23: Version 1.0.4 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run picklescan (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

PickleScan relies on a blocklist of unsafe Python modules and functions to prevent remote code execution through pickle deserialization. The vulnerability exists in the incomplete _unsafe_globals dictionary (scanner.py lines 120–219), which fails to include at least seven standard library modules: uuid, _osx_support, _aix_support, _pyrepl.pager, imaplib, test, and test.support.script_helper. These modules expose eight functions with direct command execution capabilities (subprocess.Popen, os.system) that attackers can invoke through crafted pickle files. The attack requires no authentication or user interaction—an attacker simply creates a malicious pickle file, and when any system using PickleScan processes it, the scanner reports zero issues while the deserialization executes arbitrary commands. This affects all downstream consumers including HuggingFace Hub, ML pipelines, and model registries. The fix is to add these modules to the blocklist (released in version 1.0.4), but the advisory recommends architectural changes to switch from a blocklist (default-allow) to an allowlist (default-deny) model.

Affected products

  • GitHub PickleScan < 1.0.4

Timeline

  • 2026-03-02: disclosed: Original advisory GHSA-g38g-8gr9-h9xp published
  • 2026-06-23: disclosed: Duplicate advisory GHSA-g7vj-qw6x-g3p8 published
  • 2026-06-23: patched: Version 1.0.4 released with fix
  • 2026-09-23: other: GHSA-g7vj-qw6x-g3p8 withdrawn as duplicate

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.