Arbitrary Code Execution Vulnerability in Picklescan
Summary
GHSA-vqmv-47xg-9wpr: Picklescan missing detection when calling pty.spawn. Affects picklescan versions < 0.0.33. Fixed in 0.0.33. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Picklescan is a Python package designed to scan and detect malicious pickle files, particularly in the context of machine learning models built with PyTorch. It aims to provide a layer of security by identifying potentially harmful code embedded within serialized Python objects. However, a recent vulnerability has been discovered that allows attackers to bypass this detection mechanism, posing significant risks to users relying on this tool for security.
Vulnerability Detail
The vulnerability arises from the use of the pty.spawn function within the reduce method of a crafted payload. When a victim scans a pickle file using Picklescan, the tool fails to detect the malicious code, leading to a false sense of security. This allows attackers to execute arbitrary commands on the host system when the victim loads the infected pickle file. The implications are severe, as it enables unauthorized access and control over the victim's environment, potentially leading to data breaches or system compromise.
How To Fix
Latest published version: 1.0.5 as of 22 Oct 2026
pip install --upgrade "picklescan==1.0.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.33
This is the first release that contains the fix.
pip install --upgrade "picklescan==0.0.33"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid loading pickle files from untrusted sources or implement additional validation checks before deserializing any pickle data. However, the best course of action is to update to the patched version as soon as possible.
Conclusion
The vulnerability in Picklescan highlights the importance of maintaining updated security tools and being vigilant about the sources of serialized data. Users are strongly encouraged to update to the latest version to mitigate risks associated with arbitrary code execution.
See every vulnerability recorded for picklescan →
FAQ
The vulnerability allows attackers to execute arbitrary code through malicious pickle files that go undetected by Picklescan.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to test your application without needing to sign up.
The CVSS score for this vulnerability is 8.9, indicating a high severity level.
If immediate updates are not possible, avoid loading pickle files from untrusted sources and implement additional validation checks.
Any organization or individual relying on Picklescan to detect malicious pickle files in PyTorch models is at risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for picklescan.
