Arbitrary File Writing Vulnerability in Picklescan
Summary
GHSA-m273-6v24-x4m4: Picklescan vulnerable to Arbitrary File Writing. Affects picklescan versions < 0.0.33. Fixed in 0.0.33. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Picklescan is a Python package designed to safely handle pickled data, providing functionality to prevent common security issues associated with deserialization. It employs a blocklist to restrict the use of certain functions that could lead to vulnerabilities. However, the package's current implementation fails to block the distutils module, leaving it susceptible to arbitrary file writing attacks.
Vulnerability Detail
The vulnerability arises from the fact that Picklescan does not include the distutils module in its blocklist, allowing attackers to exploit this oversight. By crafting a malicious pickle object that utilizes distutils.file_util.write_file, an attacker can overwrite critical system files, such as .ssh/authorized_keys or web server configurations. This could lead to denial of service (DoS) or remote code execution (RCE), posing significant risks to affected systems.
How To Fix
Latest published version: 1.0.5 as of 22 Oct 2026
pip install --upgrade "picklescan==1.0.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.33
This is the first release that contains the fix.
pip install --upgrade "picklescan==0.0.33"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually add distutils to the blocklist in your implementation of Picklescan. Ensure that your code includes the following line to prevent the use of distutils: picklescan.blocklist.append('distutils').
Conclusion
The Picklescan package is vulnerable to arbitrary file writing due to the oversight of not blocking the distutils module. Users are advised to update to version 0.0.33 or later to mitigate this risk. In the meantime, a temporary workaround is available to help secure applications against potential exploitation.
See every vulnerability recorded for picklescan →
FAQ
The CVSS score of this vulnerability is 8.9, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without requiring signup.
Exploitation of this vulnerability can lead to arbitrary file overwriting, resulting in denial of service or remote code execution, which can severely compromise system integrity.
Yes, you can temporarily mitigate the vulnerability by adding distutils to the blocklist in your implementation of Picklescan.
If immediate updates are not possible, implement the workaround by modifying the blocklist to include distutils until you can upgrade to the patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for picklescan.
