Malicious Code Execution in pafex Package - Security Alert
Summary
MAL-2026-18094: Malicious code in pafex (PyPI). Affects pafex versions 2.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pafex package, available on PyPI, is a Python library that is often used as a dependency in various applications. It is designed to facilitate certain functionalities within Python projects. However, it has been found to contain malicious code that exploits the unpickling process, leading to potential security breaches. This vulnerability poses a significant risk to users who rely on pafex for their projects, as it can lead to unauthorized access and control over their systems.
Vulnerability Detail
The vulnerability originates from a malicious campaign identified as '2026-10-webreader'. The main package, resion, embeds a pickle file disguised as a configuration file. The pafex dependency contains code that loads this pickle file. During the unpickling process, malicious code is executed automatically, establishing persistence on the victim's machine through a PTH file and downloading further payloads. The malicious actions include file exfiltration, remote command execution, and potential control over the victim's system.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall pafexIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the pafex package until a secure version is confirmed. Additionally, ensure that any pickled data is sourced from trusted origins only, and consider using safer serialization methods such as JSON or YAML instead of pickle.
Conclusion
The pafex package has been identified as containing malicious code that can execute during the unpickling process, posing a significant security risk. Users are advised to update their packages and exercise caution with untrusted data. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for pafex →
FAQ
The vulnerability involves malicious code execution during the unpickling of a compromised pickle file, which can lead to unauthorized access and control over the system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you have installed pafex, immediately update to the latest version using 'pip install --upgrade pafex' to mitigate the risk.
The consequences include unauthorized access to sensitive data, remote command execution, and the establishment of persistence on the victim's machine.
To prevent similar vulnerabilities, always validate and sanitize inputs, avoid using pickle for untrusted data, and regularly update dependencies to their latest secure versions.
