Arbitrary Code Execution Risk in PickleScan due to Unsafe Globals Bypass
Summary
GHSA-hgrh-qx5j-jfwx: Picklescan Bypasses Unsafe Globals Check using pty.spawn. Affects picklescan versions < 0.0.33. Fixed in 0.0.33. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PickleScan is a security tool designed to analyze Python pickle files for potential threats, particularly in machine learning models and other serialized data formats. It aims to identify and mitigate risks associated with executing untrusted pickle data. However, a recent vulnerability has been discovered that allows attackers to bypass its safety checks, posing significant risks to users relying on this tool for secure data handling.
Vulnerability Detail
The vulnerability in PickleScan arises from its failure to include the 'pty.spawn' function in its list of unsafe globals. This oversight allows malicious actors to craft pickle payloads that exploit this function, leading to potential arbitrary code execution. Attackers can disguise harmful payloads within files that would typically be scanned for threats, thereby circumventing the intended security measures. The issue was highlighted during the 2025 HeroCTF event, where participants demonstrated the ability to bypass PickleScan's defenses using this method.
How To Fix
Latest published version: 1.0.5 as of 22 Oct 2026
pip install --upgrade "picklescan==1.0.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.33
This is the first release that contains the fix.
pip install --upgrade "picklescan==0.0.33"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid processing untrusted pickle files until they have updated to the patched version. Additionally, users can manually inspect pickle files for suspicious content before loading them into their applications.
Conclusion
The vulnerability in PickleScan poses a significant risk to users by allowing arbitrary code execution through a bypass of unsafe globals checks. It is crucial for users to update to the latest version to mitigate this risk and ensure secure handling of pickle files.
See every vulnerability recorded for picklescan →
FAQ
The vulnerability allows attackers to bypass safety checks for unsafe globals, specifically using the 'pty.spawn' function, leading to potential arbitrary code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
As a workaround, avoid processing untrusted pickle files and manually inspect any pickle data before loading it into your application.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
You can visit the official PickleScan repository on GitHub for more details about its functionality and updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for picklescan.
