Executive brief
picklescan is a security library used to scan Python pickle files for potentially malicious code before loading them. Attackers can craft pickle files that call Python's built-in cProfile.runctx function to execute arbitrary commands, bypassing picklescan's detection. When a user loads such a file after checking it with picklescan, the attacker gains remote code execution on the system.
Technical details
This vulnerability is a deserialization bypass (CWE-502) in picklescan's detection logic. The root cause is that picklescan fails to identify cProfile.runctx, a built-in Python profiling function that can execute arbitrary code, when it is called via the __reduce__ method in pickle serialization. An attacker constructs a malicious pickle file containing cProfile.runctx(cmd, globals, locals) in the reduce method, which effectively calls exec(cmd, ...) at deserialization time. The attack requires user interaction (victim must call pickle.load() on an untrusted file) but no privileges; it is exploitable over the network if the pickle file can be transmitted remotely. The vulnerability affects picklescan versions before 0.0.30, which includes a patch to detect this function call pattern.
Affected products
- mmaitre314 picklescan < 0.0.30
Timeline
- 2026-06-21: disclosed: Advisory published
- 2026-06-21: patched: Version 0.0.30 released with fix