# Picklescan scanning bypass in scan_pytorch via eval injection

Source: https://junglewise.ai/threats/picklescan-scanning-bypass-in-scan-pytorch-via-eval-injection-02602a50  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-17. Updated: 2026-06-18  
License: CC BY 4.0 with a link back

Severity: high · CVSS 7.1 · Published 2026-06-17

Picklescan is a security tool used to scan machine learning models for malicious code before they are loaded. A vulnerability in how it checks PyTorch files allows attackers to hide malicious code inside a model file in a way that bypasses the scanner's detection. If a user is tricked into loading one of these "clean-looking" but malicious files, an attacker could execute arbitrary commands on the user's computer.

Technologies: [picklescan (PyPI)](https://junglewise.ai/threats/technologies/picklescan). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 7.1, published 17 June 2026.

**Which products and versions are affected?** picklescan (PyPI) < 1.0.3.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run picklescan (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A scanning bypass exists in picklescan's 'scan_pytorch' function due to a discrepancy between how the scanner and PyTorch identify file magic numbers. While picklescan uses 'pickletools.genops' to look for specific integer or long opcodes, PyTorch uses 'pickle_module.load()'. An attacker can use the '__reduce__' magic method and 'eval' to dynamically generate the expected magic number at runtime. This allows a malicious PyTorch payload to appear invalid or benign to the scanner while remaining fully executable by 'torch.load()', leading to arbitrary code execution. The issue is addressed in version 1.0.3.

## Affected products

- mmaitre314 picklescan < 1.0.3

## Timeline

- 2026-02-16: advisory: Original GHSA-97f8-7cmv-76j2 published
- 2026-06-17: disclosed: CVE-2026-53875 published
- 2026-06-18: other: Duplicate advisory GHSA-cc5p-54x3-hcf8 withdrawn

## References

- [https://github.com/mmaitre314/picklescan/security/advisories/GHSA-97f8-7cmv-76j2](https://github.com/mmaitre314/picklescan/security/advisories/GHSA-97f8-7cmv-76j2)
- [https://github.com/mmaitre314/picklescan/commit/134179474539648ba7dee1317959529fbd0e7f89](https://github.com/mmaitre314/picklescan/commit/134179474539648ba7dee1317959529fbd0e7f89)
- [https://github.com/mmaitre314/picklescan/commit/2a8383cfeb4158567f9770d86597300c9e508d0f](https://github.com/mmaitre314/picklescan/commit/2a8383cfeb4158567f9770d86597300c9e508d0f)
- [https://www.vulncheck.com/advisories/picklescan-scanning-bypass-via-dynamic-eval-in-scan-pytorch](https://www.vulncheck.com/advisories/picklescan-scanning-bypass-via-dynamic-eval-in-scan-pytorch)

## Related threats

- [picklescan detection bypass via _operator.methodcaller](https://junglewise.ai/threats/cve-2025-71375-picklescan-detection-bypass-via-operator-methodcaller)
- [picklescan security bypass via operator.methodcaller](https://junglewise.ai/threats/cve-2025-71373-picklescan-security-bypass-via-operator-methodcaller)
- [Picklescan detection bypass via numpy getlincoef gadget](https://junglewise.ai/threats/cve-2025-71372-picklescan-detection-bypass-via-numpy-getlincoef-gadget)
- [picklescan safety check bypass via PyTorch decoder basichandlers](https://junglewise.ai/threats/cve-2025-71369-picklescan-safety-check-bypass-via-pytorch-decoder-basichandlers)
- [picklescan security bypass via _operator.attrgetter function call](https://junglewise.ai/threats/cve-2025-71367-picklescan-security-bypass-via-operator-attrgetter-function-call)