Read the docs
TI-2026-38871 Aliases CVE-2026-53875GHSA-97f8-7cmv-76j2

picklescan - Scanning Bypass via Dynamic Eval in scan_pytorch

Priority MEDIUM 64CWE-95Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-95.

Summary

picklescan before 1.0.3 contains a scanning bypass vulnerability in the scan_pytorch function that allows attackers to embed malicious magic numbers via dynamic eval using the __reduce__ trick. Attackers can craft malicious PyTorch payloads that evade picklescan detection while remaining executable, enabling arbitrary code execution when loaded with torch.load().

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00551 46th percentileScored 2026-11-07
Fix Fixed picklescan (picklescan): 1.0.3picklescan (PyPI): 1.0.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
picklescanpicklescanbefore 1.0.31.0.3Patch availableCNA
—picklescan (PyPI)before 1.0.31.0.3Patch availableGHSA-97f8-7cmv-76j2
  • picklescan Vendorpicklescan Affected before 1.0.3 Fixed in 1.0.3 Patch available CNA
  • picklescan (PyPI) Vendor— Affected before 1.0.3 Fixed in 1.0.3 Patch available GHSA-97f8-7cmv-76j2

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:mmaitre314:picklescan:*:*:*:*:*:*:*:*——picklescan
  • cpe:2.3:a:mmaitre314:picklescan:*:*:*:*:*:*:*:* Versions — — ·picklescan

Remediation

  • Fix · CNA picklescan (picklescan) Fixed in 1.0.3
  • Fix · GHSA-97f8-7cmv-76j2 picklescan (PyPI) Fixed in 1.0.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-53875
  2. 2026-10-03 Alias added: GHSA-97f8-7cmv-76j2
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Patch 2

Advisory 2

Other 2

  • TI-2026-03009 picklescan - Universal Blocklist Bypass via pkgutil.resolve_name CVSS 4.0CRITICAL 10.0
  • TI-2026-40680 picklescan - Remote Code Execution via Unblocked Standard Library Modules CVSS 4.0CRITICAL 9.3
  • TI-2026-38870 picklescan - Arbitrary Code Execution via Obfuscated eval Call CVSS 4.0CRITICAL 9.3
  • TI-2026-38869 picklescan - Arbitrary Code Execution via profile.run() Blocklist Bypass CVSS 4.0CRITICAL 9.3
  • TI-2025-43446 picklescan - Detection Bypass via STACK_GLOBAL Opcode Parsing Logic Flaw CVSS 4.0CRITICAL 9.3
  • TI-2025-43444 picklescan - Remote Code Execution via Unblocked ctypes Module CVSS 4.0CRITICAL 9.3
See all 57 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences