CVE-2026-56315: PickleScan Critical RCE Vulnerability Due to Unblocked Stdlib Modules
Summary
CVE-2026-56315: PickleScan has multiple stdlib modules with direct RCE not in blocklist. Affects picklescan versions < 1.0.4. Fixed in 1.0.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PickleScan is a Python package designed to scan pickle files for safety, ensuring that they do not contain malicious code. It is widely used in machine learning pipelines and model registries, including platforms like HuggingFace Hub. The package aims to provide a layer of security by identifying potentially harmful code execution paths within serialized Python objects.
Vulnerability Detail
The vulnerability in PickleScan (v1.0.3 and earlier) arises from its failure to block several Python standard library modules that can lead to remote code execution (RCE). Specifically, at least seven modules, including 'uuid', '_osx_support', and 'imaplib', are not included in the blocklist, allowing malicious pickle files to pass through the scanner undetected. This oversight can result in arbitrary command execution on the host system, posing a critical security risk, especially for applications relying on PickleScan for safety validation.
How To Fix
Latest published version: 1.0.5 as of 22 Oct 2026
pip install --upgrade "picklescan==1.0.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.4
This is the first release that contains the fix.
pip install --upgrade "picklescan==1.0.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using PickleScan to scan pickle files that may contain data from untrusted sources. Additionally, consider implementing an allowlist approach for permitted globals instead of relying solely on the blocklist.
Conclusion
The PickleScan vulnerability (CVE-2026-56315) highlights critical security flaws in the handling of pickle files, particularly due to unblocked standard library modules that allow for remote code execution. It is essential for users to update to the latest version and consider additional security measures to protect their applications.
See every vulnerability recorded for picklescan →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
All versions of PickleScan up to and including 1.0.3 are affected by this vulnerability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Check your application's vulnerability status using the Vulert playground at Vulert Scanner.
Failing to address this vulnerability can lead to remote code execution, allowing attackers to execute arbitrary commands on the host system, potentially compromising sensitive data and system integrity.
If updating is not possible, consider implementing strict input validation and avoiding the use of untrusted pickle files until a secure solution is in place.
References
Related vulnerabilities
Recent vulnerabilities recorded for picklescan.
