Picklescan Vulnerability: Pickle Parsing Logic Flaw Leading to Detection Bypass
Summary
GHSA-9gvj-pp9x-gcfr: Picklescan has pickle parsing logic flaw that leads to malicious pickle file bypass. Affects picklescan versions < 0.0.27. Fixed in 0.0.27. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Picklescan is a Python package designed for scanning and analyzing pickle files, which are a serialized format used to store Python objects. It provides functionality to detect potentially malicious pickle files by analyzing their structure and contents. However, a flaw in its parsing logic allows attackers to craft pickle files that can bypass detection mechanisms, posing a significant security risk.
Vulnerability Detail
The vulnerability arises from a parsing logic error in the Picklescan package, specifically in the handling of the opcode 'STACK_GLOBAL'. The function '_list_globals' incorrectly tracks arguments due to a range error, only considering positions from 1 to n-1 instead of the correct range from 0 to n-1. This oversight allows an attacker to place a malicious argument at position 0, leading to a detection bypass when the parser fails to track it. Consequently, this flaw can trigger unexpected exceptions, allowing malicious pickle files to evade detection by both Picklescan and Modelscan, as well as online scanning tools.
How To Fix
Latest published version: 1.0.5 as of 22 Oct 2026
pip install --upgrade "picklescan==1.0.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.27
This is the first release that contains the fix.
pip install --upgrade "picklescan==0.0.27"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using Picklescan to analyze untrusted pickle files until the package is updated. If you must analyze such files, consider using alternative methods or tools that do not exhibit this vulnerability.
Conclusion
The Picklescan vulnerability presents a significant risk due to its ability to allow malicious pickle files to bypass detection. Users are strongly encouraged to update to the latest version to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for picklescan →
FAQ
The vulnerability is a parsing logic flaw that allows malicious pickle files to bypass detection due to incorrect argument tracking.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities without requiring sign-up.
The primary consequence is the risk of undetected malicious pickle files being processed, which could lead to code execution or data compromise.
Yes, the vulnerability has been patched in version 0.0.27 of Picklescan. Users are advised to upgrade to this version.
If an immediate update is not possible, refrain from using Picklescan on untrusted pickle files until the vulnerability is resolved.
References
Related vulnerabilities
Recent vulnerabilities recorded for picklescan.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
