by Kastro
Paper/Archive/CVE-2026-53873

CVE-2026-53873

picklescan picklescan — picklescan - Arbitrary Code Execution via profile.run() Blocklist Bypass

EPSS 0.5%public exploitCVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 39.9.399 × 208.0Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

picklescan before 1.0.4 contains an incomplete blocklist for the profile module that fails to block the module-level profile.run() function, allowing attackers to achieve arbitrary code execution via exec(). Attackers can craft malicious pickle files calling profile.run(statement) to execute arbitrary Python code while picklescan reports zero security issues.

Affected

ProductAffectedFixed inSource
picklescan< 1.0.41.0.4CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/mmaitre314/picklescan/security/advisories/GHSA-7wx9-6375-f5whwriteupvulncheck.com/advisories/picklescan-arbitrary-code-execution-via-profile-run-blocklist-bypass