Executive brief
Picklescan is a library used to scan Python pickle files for malicious code before they are loaded. The vulnerability allows attackers to craft pickle files containing PyTorch's torch.jit.unsupported_tensor_ops.execWrapper function calls that bypass Picklescan's detection and execute arbitrary code when the file is deserialized. This enables supply chain attacks against organizations distributing or relying on pre-trained ML models.
Technical details
The vulnerability is a deserialization flaw (CWE-502) where Picklescan fails to detect the use of torch.jit.unsupported_tensor_ops.execWrapper in pickle reduce methods. An attacker can craft a malicious pickle file by implementing a class with a __reduce__ method that calls execWrapper with arbitrary Python code and execution context (code string, globals, locals). When the victim calls pickle.load() after passing the file through Picklescan, the execWrapper function executes the attacker's code with no restrictions. The attack requires only that the victim load the pickle file; no authentication or special privileges are needed. Picklescan versions before 0.0.28 are affected; version 0.0.28 and later include detection for this payload pattern.
Affected products
- Picklescan Picklescan < 0.0.28
Timeline
- 2025-08-22: disclosed: Original advisory GHSA-vr7h-p6mm-wpmh published
- 2026-06-23: advisory: Duplicate advisory GHSA-q8qp-8jq6-78mc published
- 2026-06-23: patched: Version 0.0.28 available with fix