PT-2026-51155 · Picklescan · Picklescan

Ez-Lbz · Published 2026-06-20 · Updated 2026-06-20 · CVE-2026-56304

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 1.0.1

Description Unsafe pickle deserialization allows unauthenticated attackers to create arbitrary zero-byte files. This is achieved through the instantiation of the logging.FileHandler class. By crafting malicious pickle payloads, attackers can bypass remote code execution (RCE) blocklists to create lock files or other filesystem artifacts, which may lead to application disruption or denial of service.

Recommendations Update to version 1.0.1.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-56304

Affected Products

Picklescan

References · 5

• https://github.com/mmaitre314/picklescan/security/advisories/GHSA-m7j5-r2p5-c39r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56304 · Security Note
• https://twitter.com/CVEnew/status/2068380903726813285 · Twitter Post
• https://vulncheck.com/advisories/picklescan-arbitrary-file-creation-via-logging-filehandler-deserialization · Note
• https://twitter.com/infoflowcloud/status/2068382427647459655 · Twitter Post