Executive brief
picklescan is a security tool used to scan Python pickle files for malicious code. A vulnerability in versions before 0.0.35 allows an attacker to bypass security filters and read sensitive files from the server, such as system configuration files or passwords. This could lead to the exposure of confidential data to unauthorized external parties.
Technical details
picklescan before version 0.0.35 is vulnerable to unsafe pickle deserialization. While the tool implements blocklists to prevent Remote Code Execution (RCE) by filtering keywords like 'os' or 'exec', it fails to restrict other dangerous standard library components. An unauthenticated attacker can chain 'io.FileIO' to open local files and 'urllib.request.urlopen' to stream the file contents to a remote URL. This effectively bypasses RCE-focused mitigations to achieve arbitrary file read and Server-Side Request Forgery (SSRF). The issue is resolved in version 0.0.35.
Affected products
- mmaitre314 picklescan < 0.0.35
Timeline
- 2026-01-07: advisory: Original advisory GHSA-9726-w42j-3qjr published
- 2026-06-17: disclosed: CVE-2026-53872 published
- 2026-06-18: other: Duplicate advisory GHSA-5v23-73v4-w2fp withdrawn