CVE-2026-53874 Details
Description
picklescan before 1.0.1 contains an unsafe deserialization vulnerability allowing unauthenticated users to execute arbitrary code by hiding eval calls nested under callable objects via getattr. Attackers can embed malicious code in pickle files that evades detection but executes when the pickle is loaded from untrusted sources.
A vulnerability in Picklescan versions prior to 1.0.1 allows unsafe deserialization, enabling unauthenticated users to execute arbitrary code. This is achieved by hiding evaluation calls within callable objects, which can then be executed when the pickle file is loaded from untrusted sources. Attackers can embed malicious code in pickle files that evades detection but executes upon deserialization.
Users are advised to update Picklescan to version 1.0.1 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 17, 2026CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mmaitre314/picklescan/security/advisories/GHSA-9m3x-qqw2-h32h | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/mmaitre314/picklescan/security/advisories/GHSA-9m3x-qqw2-h32h | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-obfuscated-eval-call | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mmaitre314 picklescan | < 1.0.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | New CVE Received | [email protected] |