PickleScan vulnerabilities
We track 50 vulnerabilities in PickleScan products. 50 are rated high or critical, and none are known to be exploited. The most recent was published on July 4, 2026.
Latest PickleScan vulnerabilities
- 9.8 Critical severity
picklescan: Deserialization of Untrusted Data
picklescan before 1.0.1 contains an unsafe deserialization vulnerability allowing unauthenticated users to execute arbitrary code by hiding eval calls nested under callable objects via getattr. Attackers can embed malicious code in pickle files that evades det
- 9.8 Critical severity
picklescan: Incomplete List of Disallowed Inputs
picklescan before 1.0.4 contains an incomplete blocklist for the profile module that fails to block the module-level profile.run() function, allowing attackers to achieve arbitrary code execution via exec(). Attackers can craft malicious pickle files calling p
- 7.5 High severity
picklescan: Improper Limitation of a Pathname to a Restricted Directory
picklescan before 0.0.35 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to read arbitrary server files by chaining io.FileIO and urllib.request.urlopen. Attackers can bypass RCE-focused blocklists to exfiltrate sensi
- 10.0 Critical severity
picklescan: Permissive List of Allowed Inputs
picklescan before 1.0.4 fails to block pkgutil.resolve_name, allowing attackers to bypass the entire blocklist by resolving any dangerous function through indirect REDUCE calls. Remote attackers can invoke any blocked function such as os.system, builtins.exec,
- 9.8 Critical severity
picklescan before 0.0.27 contains a parsing logic error in the _list_globals function when…
picklescan before 0.0.27 contains a parsing logic error in the _list_globals function when handling STACK_GLOBAL opcodes, failing to track arguments in the correct range and allowing malicious pickle files to bypass detection. Attackers can craft pickle files
- 9.8 Critical severity
picklescan: Incomplete List of Disallowed Inputs
picklescan before 0.0.33 fails to block the ctypes module, allowing attackers to achieve remote code execution by invoking direct syscalls and accessing raw memory. Attackers can craft malicious pickle files using ctypes.WinDLL to load kernel32.dll and execute
- 8.8 High severity
PickleScan: Protection Mechanism Failure
PickleScan before 0.0.33 fails to include the pty.spawn function in its unsafe globals list, allowing attackers to bypass security checks. Malicious actors can craft pickle payloads using pty.spawn to achieve arbitrary code execution when files are processed b
- 9.8 Critical severity
picklescan: Deserialization of Untrusted Data
picklescan before 0.0.33 contains an arbitrary file writing vulnerability that allows attackers to bypass the dangerous blocklist by using distutils.file_util.write_file. Attackers can construct malicious pickle objects to overwrite critical system files and a
- 9.8 Critical severity
picklescan: Incomplete List of Disallowed Inputs
picklescan before 0.0.33 contains an incomplete deny-list that fails to block pydoc.locate and operator.methodcaller functions, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle files using these unblocked functions to a
- 7.5 High severity
Picklescan: Incomplete List of Disallowed Inputs
The unsafe globals in Picklescan before 0.0.25 do not include ssl. Consequently, ssl.get_server_certificate can exfiltrate data via DNS after deserialization.