Critical Remote Code Execution Vulnerability in PickleScan
Summary
GHSA-g38g-8gr9-h9xp: PickleScan has multiple stdlib modules with direct RCE not in blocklist. Affects picklescan versions < 1.0.4. Fixed in 1.0.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PickleScan is a Python package designed to scan pickle files for safety, ensuring that potentially harmful code is not executed when loading these files. It is widely used in machine learning pipelines and model registries, including platforms like HuggingFace Hub. The package aims to provide a layer of security by identifying unsafe code patterns within serialized Python objects.
Vulnerability Detail
The vulnerability in PickleScan (version 1.0.3 and earlier) arises from its failure to block several Python standard library modules that can execute arbitrary commands. This oversight allows malicious pickle files to pass through the scanner undetected, leading to potential remote code execution (RCE). Specifically, at least seven modules, including 'uuid' and 'imaplib', can be exploited to run arbitrary commands without triggering any alerts from PickleScan. The CVSS score for this vulnerability is 9.8, indicating a critical risk level that affects all deployments relying on PickleScan.
How To Fix
Latest published version: 1.0.5 as of 22 Oct 2026
pip install --upgrade "picklescan==1.0.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.4
This is the first release that contains the fix.
pip install --upgrade "picklescan==1.0.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually inspect pickle files for the presence of the vulnerable modules before loading them. Additionally, consider implementing a custom blocklist for known dangerous modules until the package can be updated.
Conclusion
The critical vulnerability in PickleScan allows for remote code execution through unblocked standard library modules, posing a significant risk to applications relying on this package. Users are strongly advised to update to the latest version to mitigate this risk.
See every vulnerability recorded for picklescan →
FAQ
PickleScan is a Python package that scans pickle files to identify potentially harmful code that could execute when the files are loaded.
All versions of PickleScan up to and including 1.0.3 are affected by this vulnerability.
The vulnerability has a CVSS score of 9.8, indicating it is critical and poses a significant risk of remote code execution.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, manually inspect pickle files for unsafe modules and consider implementing a custom blocklist as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for picklescan.
