Technical impact
Picklescan before version 0.0.28 fails to detect malicious pickle files that use torch.utils._config_module.load_config inside reduce methods. Attackers can craft pickle files that embed arbitrary code that bypasses scan checks and executes during pickle.load, allowing remote code execution in supply chain attacks. This is a classic deserialization vulnerability (CWE-502) that can compromise confidentiality, integrity, and availability of systems that rely on picklescan for dependency validation.
Affected Systems
The vulnerability affects the picklescan product from the vendor picklescan. All releases prior to version 0.0.28 are impacted. Users running earlier versions of the tool are at risk if they process untrusted pickle input.
Risk and Exploitability
With a CVSS score of 7.6, the technical impact is high, but EPSS data is not available to gauge likelihood. The weakness is not currently listed in the CISA KEV catalog, indicating no publicly known exploitation data at this time. The likely attack vector is supply‑chain or direct injection of malicious pickle payloads into environments where picklescan is invoked to load dependency data. An attacker can deliver a crafted pickle to the scan process, which will trigger execution of arbitrary code.
Github GHSA