Executive brief
Picklescan is a security tool used to scan Python pickle files for malicious code. A vulnerability was found where the tool fails to block the 'ctypes' module, which can be used to bypass security checks. An attacker could use this to execute unauthorized commands on a system, potentially leading to a full system takeover or data theft.
Technical details
Picklescan before version 0.0.33 contains an incomplete list of disallowed inputs (CWE-184) because it fails to block the 'ctypes' module. This module provides a foreign function interface (FFI) that allows loading dynamic libraries and calling C functions directly. An attacker can craft a malicious pickle file that uses 'ctypes.WinDLL' to load system libraries like 'kernel32.dll' and execute arbitrary system commands. This bypasses Picklescan's intended security model by avoiding common gadget chains and accessing raw memory directly. The vulnerability is exploitable remotely if the tool is used to scan untrusted files provided over a network.
Affected products
- mmaitre314 picklescan < 0.0.33
Timeline
- 2025-12-26: advisory: Original GHSA-4675-36f9-wf6r published
- 2026-06-17: disclosed: CVE-2025-71323 published
- 2026-06-18: patched: Version 0.0.33 released to address the issue