CVE-2026-53873: picklescan RCE Vulnerability

CVE-2026-53873 Overview

CVE-2026-53873 is an arbitrary code execution vulnerability in picklescan versions prior to 1.0.4. The tool is designed to scan Python pickle files for malicious content before they are deserialized. The vulnerability stems from an incomplete blocklist for the profile module that fails to block the module-level profile.run() function. Attackers can craft malicious pickle files that call profile.run(statement) to execute arbitrary Python code through exec() while picklescan reports zero security issues. This bypass undermines the security guarantees of any pipeline relying on picklescan to vet untrusted machine learning models or serialized Python objects.

Critical Impact
Attackers can achieve arbitrary code execution on systems that load pickle files cleared by picklescan, fully compromising machine learning supply chains and model-hosting environments.

Affected Products

picklescan versions before 1.0.4
Python machine learning pipelines using picklescan for pickle file validation
Model-hosting platforms relying on picklescan to vet user-supplied serialized objects

Discovery Timeline

2026-06-17 - CVE-2026-53873 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-53873

Vulnerability Analysis

The vulnerability is an incomplete blocklist flaw classified under [CWE-184]. picklescan enumerates dangerous Python modules and functions that should not appear inside pickle streams. The blocklist for the profile module omits the module-level profile.run() function. When a pickle stream invokes profile.run(statement), the underlying Python implementation passes statement to exec(), executing arbitrary code at deserialization time.

Because profile.run() is not flagged, picklescan returns a clean result. Downstream code then calls pickle.load() on the file, triggering execution. The flaw is a classic instance of an incomplete denylist failing to enumerate every dangerous code path that reaches an interpreter sink.

Root Cause

The root cause is reliance on an incomplete blocklist of dangerous callables. The scanner enumerated several entries in the profile module but did not include profile.run, which internally invokes exec() on its first argument. Any unblocked function that reaches an interpreter primitive becomes a usable gadget for code execution.

Attack Vector

An attacker crafts a pickle file containing a REDUCE opcode that references profile.run with a payload string of attacker-controlled Python code. The file is distributed through a model hub, dataset repository, or any channel where the victim runs picklescan before loading the pickle. picklescan reports no issues. When the victim subsequently deserializes the file with pickle.load(), profile.run() executes the supplied statement through exec(), granting the attacker arbitrary code execution in the victim's Python process.

The vulnerability mechanism is documented in the GitHub Security Advisory and the VulnCheck Advisory on Picklescan.

Detection Methods for CVE-2026-53873

Indicators of Compromise

Pickle files containing references to profile.run or the cProfile.run callable in the global imports section of the pickle stream
Unexpected child processes spawned by Python interpreters shortly after loading .pkl, .pickle, .pt, or .bin model artifacts
picklescan scan logs reporting zero issues immediately followed by anomalous outbound network connections from the same process
New or modified Python scripts, cron entries, or shell history written by the user account running model-loading workloads

Detection Strategies

Inspect pickle files with pickletools.dis() and flag any GLOBAL opcode referencing profile, cProfile, or other modules that wrap exec() or eval()
Run untrusted pickle deserialization inside sandboxed or ephemeral environments where process and network telemetry is collected
Correlate picklescan scan results with runtime telemetry to identify cases where a clean scan precedes suspicious process activity
Maintain a build-time check in CI/CD pipelines that fails when picklescan version is below 1.0.4

Monitoring Recommendations

Monitor Python processes for unexpected invocations of exec(), shell spawns, and writes to sensitive paths after pickle load operations
Alert on outbound connections from data science workloads to non-allowlisted destinations
Track installed versions of picklescan across developer workstations, build agents, and inference servers

How to Mitigate CVE-2026-53873

Immediate Actions Required

Upgrade picklescan to version 1.0.4 or later across all environments that scan pickle files
Treat any pickle file scanned with a vulnerable picklescan version as untrusted and rescan it with the patched version
Audit recently loaded models and datasets for indicators of unauthorized code execution
Restrict pickle deserialization to artifacts from trusted, signed sources

Patch Information

The maintainers fixed the issue in picklescan 1.0.4 by extending the blocklist to cover profile.run and related callables that reach exec(). Refer to the GitHub Security Advisory for the patched commit and release notes.

Workarounds

Avoid loading pickle files from untrusted sources entirely and prefer safer serialization formats such as safetensors for model weights
Run pickle deserialization in isolated containers with no network egress and minimal filesystem permissions
Implement a custom pickle.Unpickler subclass that overrides find_class() with a strict allowlist of permitted classes

bash

# Upgrade picklescan to the patched release
pip install --upgrade 'picklescan>=1.0.4'

# Verify the installed version
python -c "import picklescan, importlib.metadata; print(importlib.metadata.version('picklescan'))"