CVE-2026-53874: picklescan RCE Vulnerability

CVE-2026-53874 Overview

CVE-2026-53874 is an unsafe deserialization vulnerability [CWE-502] in picklescan versions prior to 1.0.1. The tool is designed to detect malicious content in Python pickle files, but attackers can bypass its scanning logic by hiding eval calls nested under callable objects via getattr. Malicious pickle files pass scanning unflagged, then execute arbitrary code when loaded from untrusted sources. The flaw enables unauthenticated remote code execution against any system that relies on picklescan to validate pickle artifacts before deserialization, including machine learning model distribution pipelines that handle PyTorch and similar serialized formats.

Critical Impact
Unauthenticated attackers can execute arbitrary code on any host that loads an attacker-crafted pickle file previously validated as safe by vulnerable picklescan versions.

Affected Products

picklescan versions before 1.0.1
Machine learning pipelines using picklescan to validate untrusted model files
Applications loading pickle artifacts after scanning with vulnerable picklescan releases

Discovery Timeline

2026-06-17 - CVE-2026-53874 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-53874

Vulnerability Analysis

The vulnerability resides in picklescan's static analysis of pickle opcodes. The scanner enumerates a list of known dangerous callables such as builtins.eval and builtins.exec, then flags any pickle that references them directly. Attackers bypass this enumeration by reaching the same dangerous functions indirectly through getattr against a benign-looking module or callable object. The pickle stream resolves the dangerous callable at load time, but the static scanner sees only an allowlisted symbol and a string argument. When the victim deserializes the file, Python executes the attacker-controlled payload with the privileges of the loading process.

The practical impact is full code execution on hosts that fetch pickle files from model registries, shared storage, or other untrusted sources. Successful exploitation grants remote code execution, host compromise, lateral movement opportunities, and potential theft of model weights, training data, or credentials cached on the host.

Root Cause

The root cause is incomplete allowlisting in picklescan's opcode analyzer. The scanner does not recursively resolve attribute lookups produced by getattr chains, so dangerous functions reached indirectly are treated as safe. Pickle's REDUCE opcode invokes the resolved callable at load time, defeating the scanner's static guarantees.

Attack Vector

An attacker crafts a pickle file whose opcode stream calls getattr(builtins, 'eval') and applies the resulting callable to an attacker-controlled string. The file is uploaded to a model hub, shared dataset repository, or any channel a victim trusts. When the victim scans the file with a vulnerable picklescan version, the scanner reports no findings. Subsequent calls to pickle.load or torch.load execute the embedded payload. No authentication, user interaction, or local access is required on the loading host.

Detailed technical write-ups are available in the GitHub Security Advisory and the VulnCheck Advisory on PickleScan.

Detection Methods for CVE-2026-53874

Indicators of Compromise

Pickle files containing GLOBAL or STACK_GLOBAL opcodes referencing builtins.getattr followed by string operands such as 'eval', 'exec', or 'compile'.
Python processes spawning shells, network utilities, or interpreters immediately after a pickle.load or torch.load call.
Outbound network connections from hosts that recently ingested model files from third-party registries.
Unexpected child processes from data-science workloads such as Jupyter kernels or model-serving containers.

Detection Strategies

Inspect pickle streams with pickletools.dis and alert on any getattr reduction whose string argument resolves to a dangerous callable.
Sandbox pickle loading in an isolated environment and monitor syscalls for execve, fork, and outbound socket creation.
Apply YARA or content rules against stored pickle artifacts to flag getattr followed by eval, exec, compile, or __import__ literals.
Compare picklescan package versions across build hosts and developer workstations against the fixed release 1.0.1.

Monitoring Recommendations

Log all model-file ingestion events with hash, source URL, and the scanner version used.
Forward host telemetry from ML training and inference nodes to a centralized analytics platform for behavioral correlation.
Alert on Python interpreters establishing outbound connections to non-allowlisted destinations.
Track installed picklescan versions through software bill of materials reporting.

How to Mitigate CVE-2026-53874

Immediate Actions Required

Upgrade picklescan to version 1.0.1 or later across all environments that scan or distribute pickle files.
Re-scan previously trusted pickle artifacts with the patched version and quarantine any files that now produce findings.
Treat pickle files from external sources as untrusted regardless of prior scan results until rescanned.
Rotate credentials and tokens accessible from any host that loaded untrusted pickle files since the vulnerable version was deployed.

Patch Information

The maintainers fixed the bypass in picklescan1.0.1 by extending opcode analysis to resolve indirect attribute lookups against the dangerous-callable allowlist. Install the fix with pip install --upgrade picklescan>=1.0.1. Review the GitHub Security Advisory GHSA-9m3x-qqw2-h32h for the full patch description.

Workarounds

Replace pickle-based model loading with safer formats such as safetensors where the framework supports it.
Restrict pickle deserialization to an isolated container or virtual machine with no network egress and no access to secrets.
Use a custom pickle.Unpickler subclass that overrides find_class to allow only a strict allowlist of classes.
Block ingestion of pickle files from untrusted registries at the network or storage layer until the patched scanner is deployed.

bash

# Configuration example
pip install --upgrade 'picklescan>=1.0.1'
picklescan --path ./models --version