High Severity Vulnerability in Picklescan: ZIP Archive Scan Bypass Due to CRC Check Failure
Summary
GHSA-mjqp-26hc-grxg: Picklescan: ZIP archive scan bypass is possible through non-exhaustive Cyclic Redundancy Check. Affects picklescan versions < 0.0.31. Fixed in 0.0.31. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Picklescan is a Python package designed to scan ZIP archives for malicious pickle files, primarily used in conjunction with PyTorch models. Its functionality is crucial for ensuring the security of applications that load serialized objects, particularly in environments where untrusted data may be processed. However, a significant vulnerability exists that compromises its ability to detect malicious payloads when ZIP archives contain files with bad Cyclic Redundancy Check (CRC) values.
Vulnerability Detail
The vulnerability arises from Picklescan's reliance on Python's built-in zipfile module, which raises exceptions when encountering files with CRC mismatches. Instead of attempting to scan the contents of the ZIP archive, Picklescan fails and returns an error, effectively allowing attackers to hide malicious pickle payloads within these archives. This issue is particularly concerning as PyTorch may still load these models, bypassing CRC checks, thus creating a significant security risk where malicious code can be executed without detection.
How To Fix
Latest published version: 1.0.5 as of 22 Oct 2026
pip install --upgrade "picklescan==1.0.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.31
This is the first release that contains the fix.
pip install --upgrade "picklescan==0.0.31"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can modify the Picklescan source code to implement a relaxed ZIP file handling approach. Below is a code snippet that can be added to the relaxed_zipfile.py file within the Picklescan source code:
class RelaxedZipFile(zipfile.ZipFile):
# Existing code...
# Create the ZipExtFile and disable CRC check
ext_file = zipfile.ZipExtFile(zef_file, mode, zinfo, pwd)
# Monkey-patch to skip CRC validation
ext_file._expected_crc = None
return ext_file
Conclusion
The vulnerability in Picklescan poses a significant risk to users relying on it for scanning ZIP archives containing pickle files. By updating to the latest version or applying the suggested workaround, users can enhance their security posture against potential attacks leveraging this flaw.
See every vulnerability recorded for picklescan →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Attackers can craft malicious PyTorch models with embedded pickle payloads, which can be loaded without detection by Picklescan, leading to potential execution of malicious code.
Yes, the vulnerability has been patched in version 0.0.31 of Picklescan. Users should upgrade to this version to mitigate the risk.
If an immediate update is not possible, consider implementing the provided workaround to modify the ZIP file handling in the source code.
References
Related vulnerabilities
Recent vulnerabilities recorded for picklescan.
