Sign in
Deutsch English Español Polski
Critical

picklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. An attacker could craft a malicious model that uses Pickle and include a malicious pick

  • Disclosed: 26.02.2025
  • Updated: 11.10.2026 13:19

picklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. An attacker could craft a malicious model that uses Pickle and include a malicious pickle file with a non-standard file extension. Because the malicious pickle file inclusion is not considered as part of the scope of picklescan, the file would pass security checks and appear to be safe, when it could instead prove to be problematic.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) picklescan < 0.0.22 0.0.22

References

CVSS score 9.8/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE)
CWE-646, CWE-184
Platform
Python (PyPI)
Package
picklescan
Disclosed
26.02.2025
Updated
11.10.2026 13:19

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2025-18 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-655q-fx9r-782v - CC BY 4.0

OSV / GitHub Advisory Database - GHSA-769v-p64c-89pr - CC BY 4.0

OSV / GitHub Advisory Database - PYSEC-2025-19 - PyPA Advisory Database; CC BY 4.0

Vulnerability history: picklescan

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (58) in the archive
Total entries
58
First → latest
02.2025 03.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 7
  • High 25
  • Medium 26

Disclosures per year

Severity:
  1. PickleScan has multiple stdlib modules with direct RCE not in blocklist
    Critical · 9.8 CVE-2026-56315 < 1.0.4 1.0.4
  2. PickleScan's pkgutil.resolve_name has a universal blocklist bypass
    Critical · 10.0 CVE-2026-3490 < 1.0.4 1.0.4
  3. PickleScan's profile.run blocklist mismatch allows exec() bypass
    Critical · 9.8 CVE-2026-53873 < 1.0.4 1.0.4
  4. Picklescan (scan_pytorch) Bypass via dynamic eval MAGIC_NUMBER
    High CVE-2026-53875 < 1.0.3 1.0.3
  5. picklescan missing detection by simple obfuscation of a `builtins.eval` call
    High CVE-2026-53874 < 1.0.1 1.0.1
  6. picklescan has Arbitrary file read using `io.FileIO`
    High · 7.5 CVE-2026-53872 < 0.0.35 0.0.35
  7. Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.attrgetter
    High CVE-2025-71367 < 0.0.34 0.0.34
  8. Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.methodcaller
    High CVE-2025-71375 < 0.0.34 0.0.34
  9. Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.getlincoef
    High CVE-2025-71372 < 0.0.33 0.0.33
  10. Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran.myeval
    High · 8.1 CVE-2025-71365 < 0.0.33 0.0.33
  11. Picklescan is vulnerable to RCE through missing detection when calling built-in python operator.methodcaller
    High CVE-2025-71373 < 0.0.33 0.0.33
  12. Picklescan missing detection when calling numpy.f2py.crackfortran.getlincoef
    High CVE-2025-71362 < 0.0.33 0.0.33
  13. Picklescan Bypasses Unsafe Globals Check using pty.spawn
    High · 8.8 CVE-2025-71322 < 0.0.33 0.0.33
  14. Picklescan missing detection when calling pty.spawn
    High ghsa-vqmv-47xg-9wpr < 0.0.33 0.0.33
  15. Picklescan has Incomplete List of Disallowed Inputs
    High CVE-2025-71320 < 0.0.33 0.0.33
  16. Picklescan does not block ctypes
    High · 9.8 CVE-2025-71323 < 0.0.33 0.0.33
  17. Picklescan vulnerable to Arbitrary File Writing
    High CVE-2025-71321 < 0.0.33 0.0.33
  18. Picklescan Bypass is Possible via File Extension Mismatch
    Critical · 7.8 CVE-2025-10155 < 0.0.31 0.0.31
  19. Picklescan: ZIP archive scan bypass is possible through non-exhaustive Cyclic Redundancy Check
    Critical · 7.5 CVE-2025-10156 < 0.0.31 0.0.31
  20. Picklescan is Vulnerable to Unsafe Globals Check Bypass through Subclass Imports
    Critical · 8.3 CVE-2025-10157 < 0.0.31 0.0.31
  21. Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcommand
    High CVE-2025-71357 < 0.0.30 0.0.30
  22. Picklescan is missing detection when calling built-in python ensurepip._run_pip
    High · 8.1 CVE-2025-71344 < 0.0.30 0.0.30
  23. Picklescan has a missing detection when calling built-in python idlelib.calltip.Calltip
    High · 8.1 CVE-2025-71361 < 0.0.29 0.0.29
  24. Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.fetch_completions
    High · 8.1 CVE-2025-71376 < 0.0.29 0.0.29
  25. Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.get_entity
    High · 8.1 CVE-2025-71358 < 0.0.29 0.0.29
  26. Picklescan has a missing detection when calling built-in python idlelib.debugobj.ObjectTreeItem
    High · 8.1 CVE-2025-71354 < 0.0.29 0.0.29
  27. Picklescan has a missing detection when calling built-in python profile.Profile.runctx
    High · 8.1 CVE-2025-71341 < 0.0.29 0.0.29
  28. Picklescan is missing detection when calling pytorch function torch.utils._config_module.load_config
    High · 8.1 CVE-2025-71348 < 0.0.28 0.0.28
  29. Picklescan missing detection when calling pytorch function torch.jit.unsupported_tensor_ops.execWrapper
    High · 8.1 CVE-2025-71370 < 0.0.28 0.0.28
  30. Picklescan has pickle parsing logic flaw that leads to malicious pickle file bypass
    High CVE-2025-71325 < 0.0.27 0.0.27
  31. Picklescan Vulnerable to Exfiltration via DNS via linecache and ssl.get_server_certificate
    High CVE-2025-46417 < 0.0.25 0.0.25
  32. picklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. An attacker could craft a malicious model that uses Pickle and include a malicious pick this entry
    Critical · 9.8 CVE-2025-1716 < 0.0.22 0.0.22

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.