Executive brief
Picklescan is a security library used to scan Python pickle files for malicious code before loading them. Versions before 0.0.29 fail to detect the built-in profile.Profile.runctx function, allowing attackers to embed and execute arbitrary code on systems that rely on Picklescan for validation. This poses a serious supply chain risk for machine learning models and other serialized Python objects.
Technical details
This is a deserialization vulnerability (CWE-502) in the Picklescan detection engine. The vulnerability occurs because Picklescan does not recognize profile.Profile.runctx as a dangerous function when analyzing pickle files. An attacker can craft a malicious pickle object using profile.Profile.runctx in the __reduce__ method to execute arbitrary code. The attack requires that a victim first validates the pickle file with Picklescan (which incorrectly reports it as safe) and then loads it with pickle.load(), triggering code execution. The vulnerability affects all versions before 0.0.29, which introduced the detection for this function. The attack vector is network-based, as malicious pickles can be distributed via PyTorch models, APIs, or other supply chain channels.
Affected products
- Picklescan Picklescan < 0.0.29
Timeline
- 2025-08-26: disclosed
- 2025-08-26: patched: Version 0.0.29 released
- 2026-06-23: advisory: GHSA-mg57-j93w-g3c7 published
- 2026-09-23: other: GHSA-mg57-j93w-g3c7 withdrawn as duplicate of GHSA-6vqj-c2q5-j97w