PT-2026-50469 · Picklescan · Picklescan

Zpbrent · Publicado 2026-06-17 · Atualizado 2026-06-17 · CVE-2026-53875

Mitre

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

picklescan before 1.0.3 contains a scanning bypass vulnerability in the scan pytorch function that allows attackers to embed malicious magic numbers via dynamic eval using the reduce trick. Attackers can craft malicious PyTorch payloads that evade picklescan detection while remaining executable, enabling arbitrary code execution when loaded with torch.load().

Exploit

Correção

Eval Injection

Enumeração de Fraquezas

CWE-95

Identificadores relacionados

CVE-2026-53875

Produtos afetados

Picklescan

Referências · 4

• 🔥 https://github.com/mmaitre314/picklescan/security/advisories/GHSA-97f8-7cmv-76j2 · Exploit
• https://github.com/mmaitre314/picklescan/commit/134179474539648ba7dee1317959529fbd0e7f89 · Correção
• https://github.com/mmaitre314/picklescan/commit/2a8383cfeb4158567f9770d86597300c9e508d0f · Correção
• https://vulncheck.com/advisories/picklescan-scanning-bypass-via-dynamic-eval-in-scan-pytorch · Nota