Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
58 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
picklescan v1.0.3 (latest) does not block at least 7 Python standard library modules that provide direct arbitrary command execution or code evaluation. A malicious pickle file importing these modules is reported as having 0 issues (CLEAN scan). This enables remote code execution that bypasses picklescan entirely. Severity Critical (CVSS 9.8) — Direct RCE with zero scanner detection. Affects all deployments relying on picklescan, including HuggingFace Hub. Affected Versions - picklescan <= 1.0.3 (all versions including latest) Details Unblocked RCE Modules | Module | Function | RCE Mechanism | picklescan Result | |--------|----------|--------------|-------------------| | uuid | getcommandstdout(cmd, args) | subprocess.Popen((cmd,) + args) | CLEAN | | osxsupport | readoutput(cmdstring) | os.system() via temp file | CLEAN | | osxsupport | findbuildtool(toolname) | Command injection via %s | CLEAN | | aixsupport | readcmdoutput(cmdstring) | os.system() | CLEAN | | pyrepl.pager |…
Recommended action: Upgrade to 1.0.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
pkgutil.resolvename() is a Python stdlib function that resolves any "module:attribute" string to the corresponding Python object at runtime. By using pkgutil.resolvename as the first REDUCE call in a pickle, an attacker can obtain a reference to ANY blocked function (e.g., os.system, builtins.exec, subprocess.call) without that function appearing in the pickle's opcodes. picklescan only sees pkgutil.resolvename (which is not blocked) and misses the actual dangerous function entirely. This defeats picklescan's entire blocklist concept — every single entry in unsafeglobals can be bypassed. Severity Critical (CVSS 10.0) — Universal bypass of all blocklist entries. Any blocked function can be invoked. Affected Versions - picklescan <= 1.0.3 (all versions including latest) Details How It Works A pickle file uses two chained REDUCE calls: picklescan's opcode scanner sees: - STACKGLOBAL with module=pkgutil, name=resolvename → NOT in blocklist → CLEAN - The second REDUCE operates on…
Recommended action: Upgrade to 1.0.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
picklescan v1.0.3 blocks profile.Profile.run and profile.Profile.runctx but does NOT block the module-level profile.run() function. A malicious pickle calling profile.run(statement) achieves arbitrary code execution via exec() while picklescan reports 0 issues. This is because the blocklist entry "Profile.run" does not match the pickle global name "run". Severity High — Direct code execution via exec() with zero scanner detection. Affected Versions - picklescan v1.0.3 (latest — the profile entries were added in recent versions) - Earlier versions also affected (profile not blocked at all) Details Root Cause In scanner.py line 199, the blocklist entry for profile is: When a pickle file imports profile.run (the module-level function), picklescan's opcode parser extracts: - module = "profile" - name = "run" The blocklist check at line 414 is: This checks: is "run" in {"Profile.run", "Profile.runctx"}? Answer: NO. "run" != "Profile.run". The string comparison is exact — there is…
Recommended action: Upgrade to 1.0.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This is a scanning bypass to scanpytorch function in picklescan. As we can see in the implementation of getmagicnumber() that uses pickletools.genops(data) to get the magicnumber with the condition opcode.name includes INT or LONG, but the PyTorch's implemtation simply uses picklemodule.load() to get this magicnumber. For this implementation difference, we then can embed the magiccode into the PyTorch file via dynamic eval on the \\reduce\\ trick, which can make the pickletools.genops(data) cannot get the magiccode in INT or LONG type, but the picklemodule.load() can still return the same magiccode, eading to a bypass. PoC Attack Step 1 we can edit the source code of the function \legacy\save() as follows: Attack Step 2 with the modified version of PyTorch, we run the following PoC to generate the payload.pt: Picklescan result Victim Step then you can find the illegal file /tmp/hacked created in your local system. Impact Craft malicious PyTorch payloads to bypass picklescan,…
Recommended action: Upgrade to 1.0.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Unsafe pickle deserialization allows unauthenticated attackers to perform Arbitrary File Creation. By chaining the logging.FileHandler class, an attacker can bypass RCE-focused blocklists to create empty files on the server. The vulnerability allows creating zero-byte files in arbitrary locations but does not permit overwriting or modifying existing files. Details The application deserializes untrusted pickle data. While RCE keywords may be blocked, the exploit abuses standard library features: logging.FileHandler: The exploit instantiates this class using its default behavior (append mode). Behavior on Existing Files: If the target file already exists, the handler opens it without modifying its content, resulting in no impact to existing data. Behavior on Non-Existent Files: If the target file does not exist, the handler creates a new zero-byte file with the specified name. PoC <img width="1201" height="140" alt="313e1cfacbe700e27b6875e49808c52a"…
Recommended action: Upgrade to 1.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the host loading a pickle payload from an untrusted source. Details It's possible to hide the eval call nested under another callable via getattr. PoC Impact Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files from untrusted sources. What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded. Supply Chain Attack: Attackers can distribute infected pickle files to system that load serialized ML models, APIs, or saved Python objects from untrusted sources.
Recommended action: Upgrade to 1.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Unsafe pickle deserialization allows unauthenticated attackers to read arbitrary server files and perform SSRF. By chaining io.FileIO and urllib.request.urlopen, an attacker can bypass RCE-focused blocklists to exfiltrate sensitive data (example: /etc/passwd) to an external server. Details The application deserializes untrusted pickle data. While RCE keywords (os, exec) may be blocked, the exploit abuses standard library features: 1. io.FileIO: Opens local files without using builtins.open. 2. urllib.request.urlopen: Accepts the file object as an iterable body for a POST request. 3. Data Exfiltration: The file content is streamed directly to an attacker-controlled URL during unpickling. PoC <img width="650" height="114" alt="Screenshot 2025-12-30 at 10 13 14 PM" src="https://github.com/user-attachments/assets/4edf9640-80f6-4701-ae87-cff1079e2994" / Impact - Arbitrary file read Thanks for this library and your time. If you think picklescan is focused on detecting only RCE kind…
Recommended action: Upgrade to 0.0.35 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Picklescan uses operator.attrgetter, which is a built-in python library function to execute remote pickle files. Details The attack payload executes in the following steps: - First, the attacker crafts the payload by calling the operator.attrgetter function in the reduce method. - Then, when the victim, after checking whether the pickle file is safe by using the Picklescan library and finding that this library doesn't detect any dangerous functions, decides to call pickle.load() on this malicious pickle file, it leads to remote code execution. PoC This PoC can't be easily create by pickle.dumps, so it was manually built. Impact Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models. Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded. Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects. Report by Pinji Chen…
Recommended action: Upgrade to 0.0.34 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Picklescan uses operator.methodcaller, which is a built-in python library function to execute remote pickle files. Details The attack payload executes in the following steps: - First, the attacker crafts the payload by calling to operator.methodcaller function in reduce method - Then when after the victim after checks whether or not the pickle file is safe by using Picklescan library and the library doesn't dectect any dangerous functions, pickle.load() loads this malicious pickle file, thus lead to remote code execution. PoC This PoC can't be easily create by pickle.dumps, so it was manually built. Impact Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models. Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded. Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects. Report by Pinji Chen (cpj24@mails.tsinghua.edu.cn)…
Recommended action: Upgrade to 0.0.34 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Picklescan uses the numpy.f2py.crackfortran.evallength function (a NumPy F2PY helper) to execute arbitrary Python code during unpickling. Details Picklescan fails to detect a malicious pickle that uses the gadget numpy.f2py.crackfortran.evallength in reduce, allowing arbitrary command execution when the pickle is loaded. A crafted object returns this function plus attacker‑controlled arguments; the scan reports the file as safe, but pickle.load() triggers execution. PoC Impact - Arbitrary code execution on the victim machine once they load the “scanned as safe” pickle / model file. - Affects any workflow relying on Picklescan to vet untrusted pickle / PyTorch artifacts. - Enables supply‑chain poisoning of shared model files. Credits - ac0d3r - Tong Liu, Institute of information engineering, CAS
Recommended action: Upgrade to 0.0.33 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Picklescan uses the numpy.f2py.crackfortran.getlincoef function (a NumPy F2PY helper) to execute arbitrary Python code during unpickling. Details Picklescan fails to detect a malicious pickle that uses the gadget numpy.f2py.crackfortran.getlincoef in reduce, allowing arbitrary command execution when the pickle is loaded. A crafted object returns this function plus attacker‑controlled arguments; the scan reports the file as safe, but pickle.load() triggers execution. PoC Impact - Arbitrary code execution on the victim machine once they load the “scanned as safe” pickle / model file. - Affects any workflow relying on Picklescan to vet untrusted pickle / PyTorch artifacts. - Enables supply‑chain poisoning of shared model files. Credits - ac0d3r - Tong Liu, Institute of information engineering, CAS
Recommended action: Upgrade to 0.0.33 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Picklescan uses numpy.f2py.crackfortran.parameval, which is a function in numpy to execute remote pickle files. Details The attack payload executes in the following steps: - First, the attacker crafts the payload by calling the numpy.f2py.crackfortran.parameval function via reduce method. - Then, when the victim checks whether the pickle file is safe by using the Picklescan library and this library doesn't detect any dangerous functions, they decide to use pickle.load() on this malicious pickle file, thus leading to remote code execution. PoC Impact Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models. Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded. Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects. Report by Pinji Chen (cpj24@mails.tsinghua.edu.cn) from the NISL lab (https://netsec.ccert.edu.cn/about) at…
Recommended action: Upgrade to 0.0.33 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Picklescan uses numpy.f2py.crackfortran.myeval, which is a function in numpy to execute remote pickle files. Details The attack payload executes in the following steps: - First, the attacker crafts the payload by calling the numpy.f2py.crackfortran.myeval function in its reduce method - Then, when the victim checks whether the pickle file is safe by using the Picklescan library and this library doesn't detect any dangerous functions, they decide to use pickle.load() on this malicious pickle file, thus leading to remote code execution. PoC Impact Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models. Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded. Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects. Report by Pinji Chen (cpj24@mails.tsinghua.edu.cn) from the NISL lab (https://netsec.ccert.edu.cn/about) at…
Recommended action: Upgrade to 0.0.33 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Picklescan uses operator.methodcaller, which is a built-in python library function to execute remote pickle files. Details The attack payload executes in the following steps: - First, the attacker crafts the payload by calling the operator.methodcaller function in method reduce. - Then, when the victim checks whether the pickle file is safe using the Picklescan library and this library doesn't detect any dangerous functions, they decide to use pickle.load() on this malicious pickle file, thus leading to remote code execution. PoC This PoC can't be easily created by pickle.dumps, therefore it was manually built. Impact Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models. Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded. Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects. Report by Pinji Chen…
Recommended action: Upgrade to 0.0.33 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An unsafe deserialization vulnerability allows an attacker to execute arbitrary code on the host when loading a malicious pickle payload from an untrusted source. Details The numpy.f2py.crackfortran module exposes many functions that call eval on arbitrary strings of values. This is the case for getlincoef and evallength. This list is probably not exhaustive. According to https://numpy.org/doc/stable/reference/security.html#advice-for-using-numpy-on-untrusted-data, the whole numpy.f2py should be considered unsafe when loading a pickle. PoC Impact Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files from untrusted sources. What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded. Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects. Note The problem was originally reported to the joblib…
Recommended action: Upgrade to 0.0.33 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The vulnerability allows malicious actors to bypass PickleScan's unsafe globals check, leading to potential arbitrary code execution. The issue stems from the absence of the pty library (more specifically, of the pty.spawn function) from PickleScan's list of unsafe globals. This vulnerability allows attackers to disguise malicious pickle payloads within files that would otherwise be scanned for pickle-based threats. Details For 2025's HeroCTF, there was a challenge named Irreductible 2 where players would need to bypass the latest versions of PickleScan and Fickling to gain code execution. The challenge writeup, files and solve script have all been released. The intended way was to use pty.spawn but some players found alternative solutions. PoC - Run the following Python code to generate the PoC pickle file. - Run PickleScan on the generated pickle file. <img width="936" height="311" alt="picklescanbypassptyspawn"…
Recommended action: Upgrade to 0.0.33 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Using pty.spawn, which is a built-in python library function to execute arbitrary commands on the host system. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to pty.spawn function in the reduce method. Then the victim attempts to use picklescan to scan the pickle file for issues and sees this - The victim proceeds to load the pickle file and execute attacker-injected arbitrary code. PoC Impact Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models. What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded. Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects. Collaborators https://github.com/ajohnston9 https://github.com/geo-lit
Recommended action: Upgrade to 0.0.33 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Currently picklescanner only blocks some specific functions of the pydoc and operator modules. Attackers can use other functions within these allowed modules to go through undetected and achieve RCE on the final user. Particularly pydoc.locate: Can dynamically resolve and import arbitrary modules (e.g., resolving the string "os" to the actual os module). operator.methodcaller: Allows executing a method on an object. When combined with a resolved module object, it can execute functions like system. Since locate and methodcaller are not explicitly listed in the deny-list, picklescan treats them as "Safe" or "Suspicious" (depending on configuration) but does not flag them as "Dangerous", allowing the malicious file to bypass the security check. PoC use the provided script to create a malicious pickle file The generated payload will not be flagged as dangerous by picklescan but is actually malicious. Script to open the pickle file, demonstrating impact <img width="746"…
Recommended action: Upgrade to 0.0.33 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Picklescan doesnt flag ctypes module as a dangerous module, which is a huge issue. ctypes is basically a foreign function interface library and can be used to Load DLLs Call C functions directly Manipulate memory raw pointers. This can allow attackers to achieve RCE by invoking direct syscalls without going through blocked modules. Another major issue that ctypes being allowed presents is that it can be used down the line to dismantle interpreter based python sandboxes as ctypes allow direct access to raw memory. This is a more severe loophole than normal gadget chains and bypasses as raw memory access can be used for a lot of nefarious purposes down the line if left undetected PoC This will create a pickle file which is not detected by the latest version of picklescan as malicious <img width="1333" height="677" alt="image" src="https://github.com/user-attachments/assets/f5b066f3-116a-4377-a538-f293f3a6c176" /
Recommended action: Upgrade to 0.0.33 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Picklescan has got open() and shutil in its default dangerous blocklist to prevent arbitrary file overwrites. However the module distutils isnt blocked and can be used for the same purpose ie to write arbitrary files. Details This is another vulnerability which impacts the downstream user. By constructing a pickle that user distutils.fileutil.writefile, an attacker can overwrite critical system files (like .ssh/authorizedkeys, web server configurations, or source code) to achieve DoS or escalate to RCE. PoC <img width="853" height="197" alt="image" src="https://github.com/user-attachments/assets/a129f5aa-a050-4e88-adb7-5a6f93e35b65" / To fix this just add disutil to the blacklist
Recommended action: Upgrade to 0.0.33 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Picklescan can be bypassed, allowing the detection of malicious pickle files to fail, when a standard pickle file is given a PyTorch-related file extension (e.g., .bin). This occurs because the scanner prioritizes PyTorch file extension checks and errors out when parsing a standard pickle file with such an extension instead of falling back to standard pickle analysis. This vulnerability allows attackers to disguise malicious pickle payloads within files that would otherwise be scanned for pickle-based threats. Details The vulnerability stems from the logic in the scanbytes function within picklescan/scanner.py, specifically around line 463: https://github.com/mmaitre314/picklescan/blob/75e60f2c02f3f1a029362e6f334e1921392dcf60/src/picklescan/scanner.py#L463 The code first checks if the file extension (fileext) is in the pytorchfileextension list. If it is (e.g., .bin), the scanpytorch function is called. When a standard pickle file is encountered with a PyTorch extension,…
Recommended action: Upgrade to 0.0.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Picklescan's ability to scan ZIP archives for malicious pickle files is compromised when the archive contains a file with a bad Cyclic Redundancy Check (CRC). Instead of attempting to scan the files within the archive, whatever the CRC is, Picklescan fails in error and returns no results. This allows attackers to potentially hide malicious pickle payloads within ZIP archives that PyTorch might still be able to load (as PyTorch often disables CRC checks). Details Picklescan likely utilizes Python's built-in zipfile module to handle ZIP archives. When zipfile encounters a file within an archive that has a mismatch between the declared CRC and the calculated CRC, it can raise an exception (e.g., BadZipFile or a related error). It appears that Picklescan does not try to scan the files whatever the CRC is. This behavior contrasts with PyTorch's model loading capabilities, which in many cases might bypass CRC checks for ZIP archives - whatever the configuration is. This discrepancy…
Recommended action: Upgrade to 0.0.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The vulnerability allows malicious actors to bypass PickleScan's unsafe globals check, leading to potential arbitrary code execution. The issue stems from PickleScan's strict check for full module names against its list of unsafe globals. By using subclasses of dangerous imports instead of the exact module names, attackers can circumvent the check and inject malicious payloads. PoC 1. Download a model that uses the asyncio package: 2. Check with PickleScan: picklescan -p asyncioasynciounixeventsUnixSubprocessTransportstart.pkl -g Expected Result: PickleScan should identify all asyncio import as dangerous and flag the pickle file as malicious as asyncio is in unsafeglobals dictionary. Actual Result: PickleScan marked the import as Suspicious, failing to identify it as a dangerous import. Impact Severity: High Affected Users: Any organization, like HuggingFace, or individual using PickleScan to analyze PyTorch models or other files distributed as ZIP archives for malicious…
Recommended action: Upgrade to 0.0.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Using asyncio.unixevents.UnixSubprocessTransport.start function, which is a built-in python library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to asyncio.unixevents.UnixSubprocessTransport.start function in reduce method Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution. PoC Impact Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models. What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded. Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects. Corresponding…
Recommended action: Upgrade to 0.0.30 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Using cProfile.run function, which is a built-in python library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to cProfile.run function in reduce method Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution. PoC Impact Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models. What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded. Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects. Corresponding https://github.com/FredericDT https://github.com/Qhaoduoyu
Recommended action: Upgrade to 0.0.30 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.