Technical impact
picklescan before version 1.0.3 contains a flaw in the scan_pytorch function that allows an attacker to embed malicious magic numbers through dynamic evaluation, specifically exploiting the __reduce__ technique. This flaw bypasses picklescan’s detection mechanisms and can result in arbitrary code execution when the crafted payload is later loaded with torch.load(). The vulnerability aligns with CWE‑95, where unsafe use of eval-like functions can execute arbitrary code.
Affected Systems
The affected product is picklescan, and any installation of picklescan prior to version 1.0.3 is vulnerable. No other vendors or product variants are listed. Users running picklescan 1.0.3 or newer are not impacted.
Risk and Exploitability
The CVSS base score of 7.1 indicates a high potential impact, while the EPSS score of less than 1 % suggests a low but non‑zero probability of exploitation in the general ecosystem. The vulnerability is not currently listed in the CISA KEV catalog. Exploitation would require an attacker to supply a malicious PyTorch payload that bypasses picklescan’s scanning and is subsequently loaded by an application that uses torch.load(). The likely attack vector inferred from the description is either local file injection or remote delivery of untrusted serialized data to a system that processes it with picklescan and torch.load().
Github GHSA