Remote Code Execution Vulnerability in Picklescan Package
Summary
GHSA-x843-g5mx-g377: Picklescan uses operator.methodcaller, which is a built-in python library function to execute remote pickle files. Affects picklescan versions < 0.0.33. Fixed in 0.0.33. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Picklescan is a Python library designed to analyze and validate pickle files, particularly in machine learning contexts such as PyTorch. It aims to ensure that these files are safe to load, preventing the execution of malicious code embedded within them. However, due to its reliance on the built-in Python function operator.methodcaller, it is susceptible to remote code execution (RCE) attacks when handling crafted pickle files.
Vulnerability Detail
The vulnerability arises from the use of operator.methodcaller in the Picklescan library, which fails to detect malicious payloads that exploit this function. An attacker can create a specially crafted pickle file that, when processed by Picklescan, bypasses safety checks. This allows the attacker to execute arbitrary code on the victim's machine when the pickle file is loaded, leading to potential data breaches or system compromise. The technical details indicate that the payload is constructed to invoke system commands, demonstrating the severity of the issue.
How To Fix
Latest published version: 1.0.5 as of 22 Oct 2026
pip install --upgrade "picklescan==1.0.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.33
This is the first release that contains the fix.
pip install --upgrade "picklescan==0.0.33"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid using Picklescan to validate untrusted pickle files until the package is updated. Additionally, consider implementing manual checks or using alternative libraries that provide better security against RCE vulnerabilities.
Conclusion
The Picklescan package is vulnerable to remote code execution due to its reliance on operator.methodcaller, which can be exploited through specially crafted pickle files. Users are advised to update to version 0.0.33 or later to mitigate this risk. Regular monitoring and updates are essential for maintaining security in software applications.
See every vulnerability recorded for picklescan →
FAQ
The vulnerability allows remote code execution through crafted pickle files that exploit the operator.methodcaller function.
You can use Vulert's playground at Vulert Scanner to monitor and alert for open-source vulnerabilities without requiring installation.
The CVSS score of this vulnerability is 7.4, indicating a high severity level.
If an immediate update is not possible, refrain from using Picklescan on untrusted pickle files and consider alternative libraries.
The vulnerability was reported by Pinji Chen and Guanheng Liu from Tsinghua University.
References
Related vulnerabilities
Recent vulnerabilities recorded for picklescan.
