Executive brief
Picklescan is a security scanner used to detect malicious code embedded in Python pickle files before they are deserialized. A vulnerability allows attackers to bypass this detection by using Python's built-in idlelib.autocomplete.AutoComplete.fetch_completions function, enabling arbitrary code execution when a victim loads a seemingly-safe pickle file. This is particularly dangerous in machine learning supply chains where pre-trained models are distributed as pickle files.
Technical details
The vulnerability is a deserialization security weakness (CWE-502) in picklescan's detection logic. Attackers can craft malicious pickle files that call idlelib.autocomplete.AutoComplete.fetch_completions within a __reduce__ method, a standard pickle serialization hook. When a victim uses picklescan to verify the pickle file is safe and then calls pickle.load(), the undetected fetch_completions function executes arbitrary Python code supplied by the attacker. The vulnerability requires user interaction (the victim must decide to load the file after picklescan's check). The fix is available in picklescan version 0.0.29 and later, which adds detection for this gadget chain.
Affected products
- picklescan picklescan < 0.0.29
Timeline
- 2025-08-26: disclosed
- 0.0.29: patched