CVE-2026-53875

picklescan before 1.0.3 contains a scanning bypass vulnerability in the scan_pytorch function that allows attackers to embed malicious magic numbers via dynamic eval using the __reduce__ trick. Attackers can craft malicious PyTorch payloads that evade picklescan detection while remaining executable, enabling arbitrary code execution when loaded with torch.load().

CVSS

No CVSS.

References

Link	Resource
https://github.com/mmaitre314/picklescan/commit/134179474539648ba7dee1317959529fbd0e7f89
https://github.com/mmaitre314/picklescan/commit/2a8383cfeb4158567f9770d86597300c9e508d0f
https://github.com/mmaitre314/picklescan/security/advisories/GHSA-97f8-7cmv-76j2
https://www.vulncheck.com/advisories/picklescan-scanning-bypass-via-dynamic-eval-in-scan-pytorch
https://github.com/mmaitre314/picklescan/security/advisories/GHSA-97f8-7cmv-76j2

Configurations

No configuration.

History

26 Oct 2026, 00:10

Type	Values Removed	Values Added
Summary		(es) picklescan anterior a la versión 1.0.3 contiene una vulnerabilidad de omisión de escaneo en la función scan_pytorch que permite a los atacantes incrustar números mágicos maliciosos mediante evaluación dinámica utilizando el truco __reduce__. Los atacantes pueden crear cargas útiles maliciosas de PyTorch que evaden la detección de picklescan mientras permanecen ejecutables, lo que permite la ejecución de código arbitrario cuando se cargan con torch.load().

Information

Published : 2026-06-17 17:17

Updated : 2026-10-26 00:10

NVD link : CVE-2026-53875

Mitre link : CVE-2026-53875

CVE.ORG link : CVE-2026-53875

JSON object : View

Products Affected

No product.

CWE

CWE-95

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

{"id": "CVE-2026-53875", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53875", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-17T17:50:29.213368Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "picklescan", "product": "picklescan", "versions": [{"status": "affected", "version": "0", "lessThan": "1.0.3", "versionType": "semver"}, {"status": "unaffected", "version": "1.0.3", "versionType": "semver"}], "packageURL": "pkg:pypi/picklescan", "defaultStatus": "unaffected"}]}], "published": "2026-06-17T17:17:25.870", "references": [{"url": "https://github.com/mmaitre314/picklescan/commit/134179474539648ba7dee1317959529fbd0e7f89", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/mmaitre314/picklescan/commit/2a8383cfeb4158567f9770d86597300c9e508d0f", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-97f8-7cmv-76j2", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/picklescan-scanning-bypass-via-dynamic-eval-in-scan-pytorch", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-97f8-7cmv-76j2", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-95"}]}], "descriptions": [{"lang": "en", "value": "picklescan before 1.0.3 contains a scanning bypass vulnerability in the scan_pytorch function that allows attackers to embed malicious magic numbers via dynamic eval using the __reduce__ trick. Attackers can craft malicious PyTorch payloads that evade picklescan detection while remaining executable, enabling arbitrary code execution when loaded with torch.load()."}, {"lang": "es", "value": "picklescan anterior a la versi\u00f3n 1.0.3 contiene una vulnerabilidad de omisi\u00f3n de escaneo en la funci\u00f3n scan_pytorch que permite a los atacantes incrustar n\u00fameros m\u00e1gicos maliciosos mediante evaluaci\u00f3n din\u00e1mica utilizando el truco __reduce__. Los atacantes pueden crear cargas \u00fatiles maliciosas de PyTorch que evaden la detecci\u00f3n de picklescan mientras permanecen ejecutables, lo que permite la ejecuci\u00f3n de c\u00f3digo arbitrario cuando se cargan con torch.load()."}], "lastModified": "2026-10-26T00:10:00.150", "sourceIdentifier": "disclosure@vulncheck.com"}