File Extension Bypass Vulnerability in Picklescan
Summary
GHSA-jgw4-cr84-mqxg: Picklescan Bypass is Possible via File Extension Mismatch. Affects picklescan versions < 0.0.31. Fixed in 0.0.31. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Picklescan is an open-source Python package designed to scan files for malicious pickle objects, which can pose security risks if executed. It primarily focuses on identifying potentially harmful payloads embedded within pickle files, especially in contexts where users download or share pre-trained models in machine learning frameworks like PyTorch. However, the package has a vulnerability that allows attackers to bypass its detection mechanisms by disguising malicious pickle files with PyTorch-related file extensions, such as .bin.
Vulnerability Detail
The vulnerability arises from the logic in the scan_bytes function within picklescanhttps://vulert.com/scanner.py. When a file with a PyTorch-related extension is scanned, the function prioritizes PyTorch checks and may fail without falling back to standard pickle analysis. This flaw allows attackers to hide malicious payloads in files that would typically be scanned for threats, leading to potential execution of harmful code when such files are loaded by vulnerable applications. The CVSS score for this vulnerability is 7.8, indicating a high severity level.
How To Fix
Latest published version: 1.0.5 as of 22 Oct 2026
pip install --upgrade "picklescan==1.0.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.31
This is the first release that contains the fix.
pip install --upgrade "picklescan==0.0.31"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually rename files with PyTorch-related extensions back to standard pickle extensions (e.g., from .bin to .pkl) before scanning them with Picklescan. This allows the scanner to perform the necessary checks without bypassing the detection mechanism.
Conclusion
The file extension bypass vulnerability in Picklescan poses significant risks to users relying on the package for scanning malicious pickle files. By updating to the latest version, users can mitigate these risks and ensure better security against potential threats. Utilizing tools like Vulert can further enhance monitoring and alerting for open-source vulnerabilities.
See every vulnerability recorded for picklescan →
FAQ
The vulnerability allows malicious pickle files to bypass detection by using PyTorch-related file extensions, leading to potential execution of harmful code.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
As a temporary measure, rename files with PyTorch-related extensions to standard pickle extensions before scanning them.
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
You can find more information about Picklescan and its functionalities on its GitHub repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for picklescan.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
