Executive brief
PickleScan is a Python security tool used to scan pickle files for malicious content before deserialization. The tool fails to block at least seven standard library modules (including uuid, imaplib, and _osx_support) that contain functions capable of executing arbitrary system commands. Attackers can craft pickle files that bypass PickleScan's safety checks entirely and execute arbitrary code when the files are loaded.
Technical details
PickleScan relies on a blocklist of unsafe Python modules and functions to prevent remote code execution through pickle deserialization. The vulnerability exists in the incomplete _unsafe_globals dictionary (scanner.py lines 120–219), which fails to include at least seven standard library modules: uuid, _osx_support, _aix_support, _pyrepl.pager, imaplib, test, and test.support.script_helper. These modules expose eight functions with direct command execution capabilities (subprocess.Popen, os.system) that attackers can invoke through crafted pickle files. The attack requires no authentication or user interaction—an attacker simply creates a malicious pickle file, and when any system using PickleScan processes it, the scanner reports zero issues while the deserialization executes arbitrary commands. This affects all downstream consumers including HuggingFace Hub, ML pipelines, and model registries. The fix is to add these modules to the blocklist (released in version 1.0.4), but the advisory recommends architectural changes to switch from a blocklist (default-allow) to an allowlist (default-deny) model.
Affected products
- GitHub PickleScan < 1.0.4
Timeline
- 2026-03-02: disclosed: Original advisory GHSA-g38g-8gr9-h9xp published
- 2026-06-23: disclosed: Duplicate advisory GHSA-g7vj-qw6x-g3p8 published
- 2026-06-23: patched: Version 1.0.4 released with fix
- 2026-09-23: other: GHSA-g7vj-qw6x-g3p8 withdrawn as duplicate