Arbitrary File Read Vulnerability in picklescan: Exploiting Unsafe Pickle Deserialization
Summary
GHSA-9726-w42j-3qjr: picklescan has Arbitrary file read using io.FileIO. Affects picklescan versions < 0.0.35. Fixed in 0.0.35. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
picklescan is a Python library designed to analyze and detect vulnerabilities in pickle data serialization. It is commonly used in applications that rely on Python's pickle module for object serialization and deserialization. However, due to its reliance on untrusted data, picklescan is susceptible to vulnerabilities that can lead to unauthorized access to sensitive files on the server.
Vulnerability Detail
The vulnerability arises from unsafe pickle deserialization, which allows unauthenticated attackers to read arbitrary files on the server and perform Server-Side Request Forgery (SSRF). By leveraging the io.FileIO class and urllib.request.urlopen, an attacker can bypass restrictions aimed at preventing Remote Code Execution (RCE) and exfiltrate sensitive data, such as /etc/passwd, to an external server. This vulnerability is particularly concerning as it can lead to data breaches and unauthorized access to critical system information.
How To Fix
Latest published version: 1.0.5 as of 22 Oct 2026
pip install --upgrade "picklescan==1.0.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.35
This is the first release that contains the fix.
pip install --upgrade "picklescan==0.0.35"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid deserializing untrusted pickle data. If deserialization is necessary, implement strict validation and sanitization of the input data to mitigate potential risks.
Conclusion
The arbitrary file read vulnerability in picklescan highlights the risks associated with unsafe pickle deserialization. By updating to the latest version and implementing best practices for data handling, users can mitigate the risks and protect their applications from potential exploitation.
See every vulnerability recorded for picklescan →
FAQ
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without requiring any signup.
The potential impacts include unauthorized access to sensitive files, data breaches, and exploitation of server resources through SSRF.
To prevent this vulnerability, avoid deserializing untrusted data and implement strict validation and sanitization processes for any serialized input.
If an immediate update is not possible, implement the suggested workaround by avoiding the deserialization of untrusted data and validating inputs.
References
Related vulnerabilities
Recent vulnerabilities recorded for picklescan.
