Executive brief
picklescan is a security tool designed to detect malicious code within Python pickle files. A vulnerability in versions before 1.0.1 allows attackers to bypass these security checks by using simple code obfuscation techniques. If an organization relies on an affected version of picklescan to vet untrusted files, an attacker could successfully deliver and execute malicious code on their systems, leading to a full system compromise.
Technical details
picklescan before version 1.0.1 is vulnerable to a bypass of its security scanning logic due to improper handling of obfuscated Python objects. Specifically, the scanner fails to identify malicious 'builtins.eval' calls when they are nested under other callable objects using 'getattr'. An attacker can craft a malicious pickle file that utilizes this obfuscation to evade detection by the tool. When the resulting pickle file is loaded by a victim, the hidden payload executes arbitrary code. This is categorized as an unsafe deserialization vulnerability (CWE-502). The issue is resolved in version 1.0.1.
Affected products
- mmaitre314 picklescan < 1.0.1
Timeline
- 2026-02-02: advisory: Original GHSA-9m3x-qqw2-h32h published
- 2026-06-17: disclosed: NVD publication of CVE-2026-53874
- 2026-06-18: other: Duplicate advisory GHSA-j6c9-qvp8-699f withdrawn