CVE-2026-53875: picklescan PyTorch RCE Vulnerability

CVE-2026-53875 Overview

CVE-2026-53875 is a scanning bypass vulnerability in picklescan versions prior to 1.0.3. The flaw resides in the scan_pytorch function, which fails to detect malicious payloads that embed dynamic eval calls through the Python __reduce__ method. Attackers can craft PyTorch model files that pass picklescan static analysis while still executing arbitrary code when loaded via torch.load(). The issue is tracked under [CWE-95] (Improper Neutralization of Directives in Dynamically Evaluated Code).

Critical Impact
Malicious PyTorch model files can evade picklescan detection and execute arbitrary code on systems that load untrusted models with torch.load().

Affected Products

picklescan versions before 1.0.3
PyTorch model scanning workflows that rely on picklescan for validation
ML pipelines ingesting third-party .pt or .bin model artifacts

Discovery Timeline

2026-06-17 - CVE-2026-53875 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2026-53875

Vulnerability Analysis

picklescan is a static analysis tool that inspects pickle and PyTorch model files for unsafe opcodes and dangerous global imports. The scan_pytorch function is responsible for validating PyTorch archive contents before they are deserialized. The vulnerability stems from how the scanner identifies PyTorch payloads using fixed magic numbers and known import patterns.

Attackers bypass these checks by embedding malicious magic-number constructs that are produced at runtime through dynamic eval calls inside a __reduce__ method. Because the scanner evaluates the file statically, the runtime-generated payload is not visible during analysis. When torch.load() later deserializes the file, Python invokes the __reduce__ hook and executes the attacker-controlled code.

Root Cause

The root cause is incomplete coverage of dynamically evaluated code within scan_pytorch. The scanner relies on pattern matching against known dangerous callables but does not resolve values produced through eval, exec, or equivalent constructs reachable via the pickle __reduce__ protocol. This gap allows attackers to hide malicious globals behind dynamic expressions that only resolve at deserialization time.

Attack Vector

Exploitation requires a victim to load an attacker-supplied PyTorch model file with torch.load() after that file was approved or scanned by a vulnerable version of picklescan. Typical delivery channels include public model hubs, internal model registries, or shared artifact repositories. User interaction is required, consistent with the supply-chain nature of the attack.

The technical specifics of the bypass, including the malicious pickle stream layout, are documented in the GitHub Security Advisory GHSA-97f8-7cmv-76j2 and the VulnCheck Security Advisory. No verified public exploit code is referenced in the NVD entry.

Detection Methods for CVE-2026-53875

Indicators of Compromise

PyTorch model files containing pickle opcodes that reference builtins.eval, builtins.exec, or __reduce__ methods returning dynamically constructed callables.
Unexpected child processes spawned by Python interpreters immediately after torch.load() calls, such as shells, network utilities, or package managers.
Outbound network connections originating from data-science workloads shortly after model ingestion from untrusted sources.

Detection Strategies

Upgrade scanning tooling to picklescan 1.0.3 or later and re-scan every previously cleared model artifact.
Inspect pickle streams with multiple independent analyzers, including fickling and runtime sandboxing, rather than relying on a single static scanner.
Hash and inventory all PyTorch model files in registries, then compare against allow-lists of trusted publishers.

Monitoring Recommendations

Log every invocation of torch.load() in production inference services and alert on loads originating from non-approved paths.
Monitor Python worker processes for unexpected execve syscalls following model deserialization events.
Forward model-loading telemetry to a central data lake and correlate with process and network activity to identify post-load anomalies.

How to Mitigate CVE-2026-53875

Immediate Actions Required

Upgrade picklescan to version 1.0.3 or later across all CI/CD pipelines, model registries, and developer workstations.
Re-scan every PyTorch model artifact that was previously validated with a vulnerable picklescan release.
Quarantine models received from untrusted publishers until they are re-validated with the patched scanner and a secondary tool.

Patch Information

The maintainer addressed the bypass in picklescan 1.0.3. Fix details are available in the GitHub commit 1341794 and the follow-up commit 2a8383c. The patched scanner expands detection of dynamically constructed callables that previously evaded the scan_pytorch checks.

Workarounds

Load PyTorch models with weights_only=True where supported, which restricts deserialization to tensor data and rejects arbitrary globals.
Execute model-loading code in isolated sandboxes or ephemeral containers with no outbound network access and minimal filesystem privileges.
Restrict model ingestion to a curated allow-list of internal publishers and signed artifacts until all scanners are upgraded.

bash

# Upgrade picklescan and verify the installed version
pip install --upgrade "picklescan>=1.0.3"
picklescan --version

# Re-scan a directory of PyTorch model files
picklescan --path /models/ --globals-whitelist ""