Technical impact
The vulnerability in picklescan allows attackers to embed torch.jit.unsupported_tensor_ops.execWrapper calls within a pickle file. When a victim loads such a file using pickle.load(), the op executes arbitrary code in the context of the process. This flaw directly compromises the confidentiality, integrity, and availability of the affected system, enabling full remote code execution on the target machine.
Affected Systems
The vulnerability affects all installations of the picklescan tool before version 0.0.28. No specific sub‑versions are listed; any build of picklescan lower than 0.0.28 inherits the flaw.
Risk and Exploitability
The CVSS score of 7.6 indicates high severity. While the EPSS score is not available, the lack of listing in the CISA KEV catalog does not diminish the risk; the flaw can be exploited by crafting a malicious pickle and supplying it to any process that uses picklescan to load it. Attackers do not require special privileges to initiate the exploit; merely delivering a well‑formed pickle payload is sufficient. The attack vector is inferred to be local or remote depending on how the victim loads the pickle data, but the lack of required network permissions suggests that local compromise can further leverage the vulnerability for broader impact.
Github GHSA