CVE-2026-53873 Details
Description
picklescan before 1.0.4 contains an incomplete blocklist for the profile module that fails to block the module-level profile.run() function, allowing attackers to achieve arbitrary code execution via exec(). Attackers can craft malicious pickle files calling profile.run(statement) to execute arbitrary Python code while picklescan reports zero security issues.
An arbitrary code execution vulnerability has been identified in Picklescan versions prior to 1.0.4. The issue arises from an incomplete blocklist for the profile module, which fails to block the module-level profile.run() function. This oversight allows attackers to execute arbitrary Python code by crafting malicious pickle files that invoke profile.run(statement) using exec(). Notably, Picklescan does not detect this exploitation, reporting zero security issues.
Users can upgrade to Picklescan version 1.0.4 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 17, 2026CISA-ADP
Assessed Jun 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mmaitre314/picklescan/security/advisories/GHSA-7wx9-6375-f5wh | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/mmaitre314/picklescan/security/advisories/GHSA-7wx9-6375-f5wh | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-profile-run-blocklist-bypass | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-184 | Incomplete List of Disallowed Inputs | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| picklescan | < 1.0.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | New CVE Received | [email protected] |