CVE-2026-53872: picklescan Information Disclosure Flaw

CVE-2026-53872 Overview

CVE-2026-53872 is an arbitrary file read vulnerability in picklescan versions before 0.0.35. The flaw stems from unsafe pickle deserialization logic that fails to block file read primitives. Unauthenticated attackers can chain io.FileIO and urllib.request.urlopen to read arbitrary files on the server and exfiltrate their contents to attacker-controlled hosts. Because picklescan is commonly used to validate machine learning model files before loading, a crafted malicious pickle can defeat its scanning checks and exfiltrate sensitive data such as /etc/passwd during analysis. The issue is tracked under [CWE-22] (Path Traversal) and is documented in the GitHub Security Advisory and the VulnCheck Advisory.

Critical Impact
Unauthenticated attackers can exfiltrate arbitrary server files by submitting crafted pickle payloads that bypass picklescan blocklists focused on remote code execution.

Affected Products

picklescan versions before 0.0.35
Machine learning pipelines using picklescan to validate untrusted pickle or model files
Model hubs and CI/CD scanners integrating picklescan for safety analysis

Discovery Timeline

2026-06-17 - CVE-2026-53872 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-53872

Vulnerability Analysis

picklescan inspects pickle files for dangerous opcodes and references to known unsafe callables before they are deserialized. Its blocklist focuses on imports associated with remote code execution, such as os.system, subprocess.Popen, and builtins.eval. The scanner does not flag file I/O primitives like io.FileIO or network primitives like urllib.request.urlopen. An attacker can construct a pickle payload that, when deserialized, reads a local file through io.FileIO and then transmits its contents using urllib.request.urlopen to an external server. The result is a full read-primitive exfiltration channel that operates entirely through library functions considered benign by the scanner.

Root Cause

The root cause is incomplete blocklist coverage in picklescan's deserialization safety checks. The project enumerates dangerous imports tied to code execution but does not classify file or network primitives as sensitive. This narrow taxonomy assumes the threat model is limited to RCE, ignoring confidentiality risks from arbitrary file read and outbound data transmission. Pickle's design lets any importable callable be invoked during deserialization, so any allow-by-default policy is unsafe.

Attack Vector

An attacker delivers a malicious pickle file to a target that uses picklescan to validate untrusted models or data. The scanner reports the file as safe because it contains only io.FileIO and urllib.request.urlopen references. When the downstream application or scanner pipeline deserializes the object, the reduce chain opens a target file such as /etc/passwd, reads its bytes, and submits them in an HTTP request to an attacker-controlled URL. No authentication or user interaction is required beyond submitting the pickle for analysis. See the VulnCheck Advisory for the documented exploitation chain.

Detection Methods for CVE-2026-53872

Indicators of Compromise

Pickle files containing __reduce__ references to io.FileIO, builtins.open, or urllib.request.urlopen
Outbound HTTP or HTTPS connections from model-scanning hosts to unfamiliar external endpoints during pickle analysis
Reads of sensitive system files such as /etc/passwd, /etc/shadow, or ~/.ssh/id_rsa originating from Python processes invoking picklescan
Installed picklescan package versions earlier than 0.0.35

Detection Strategies

Inventory Python environments and CI/CD images for picklescan versions below 0.0.35 using pip list or SBOM tooling.
Statically scan pickle artifacts for opcodes referencing file or network modules in addition to the standard RCE blocklist.
Correlate pickle analysis activity with outbound network connections to detect exfiltration attempts during scanning.

Monitoring Recommendations

Log and alert on Python processes that open sensitive filesystem paths shortly after handling untrusted pickle inputs.
Restrict outbound network egress from model validation hosts and alert on unexpected destinations.
Capture and retain the raw pickle artifacts submitted to scanning services for forensic review.

How to Mitigate CVE-2026-53872

Immediate Actions Required

Upgrade picklescan to version 0.0.35 or later across all environments that process untrusted pickle files.
Treat pickle files from external or untrusted sources as untrusted code and isolate analysis in sandboxed environments.
Restrict outbound network access from hosts that scan or deserialize pickle data to prevent exfiltration.

Patch Information

The maintainer addressed the issue in picklescan0.0.35 by extending the deserialization blocklist to cover file and network primitives such as io.FileIO and urllib.request.urlopen. Patch details and the fixed version are documented in the GitHub Security Advisory.

Workarounds

Run picklescan and any pickle deserialization in containers with no network egress and read-only access to non-sensitive paths.
Prefer safe serialization formats such as safetensors for machine learning model distribution where feasible.
Add custom static checks that reject pickles referencing io, urllib, socket, shutil, or other I/O modules until upgrade is complete.

bash

# Configuration example
pip install --upgrade 'picklescan>=0.0.35'
pip show picklescan | grep -i version