Security Digest · Vulnerability record
CVE-2026-56315: PickleScan has multiple stdlib modules with direct RCE not in blocklist
picklescan before 1.0.4 fails to block at least seven Python standard library modules (including uuid, osxsupport, aixsupport, pyrepl.pager, and imaplib) exposing eight functions that provide direct arbitrary command execution.
CVSS 9.3 Critical EPSS 1.1% · p66
Should you act?
Critical and remotely reachable
No known exploitation yet, but it is network-reachable without credentials. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.
- Not in CISA KEV, but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
- EPSS 1.1%, percentile 66: FIRST’s model estimates a 1.1% chance of exploitation activity in the next 30 days, higher than 66% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
- Only applies if your dependency tree includes
picklescan(PyPI) < 1.0.4, fixed in 1.0.4. Check your lockfile, including transitive dependencies.
What it is
picklescan before 1.0.4 fails to block at least seven Python standard library modules (including uuid, osxsupport, aixsupport, pyrepl.pager, and imaplib) exposing eight functions that provide direct arbitrary command execution. Attackers can craft malicious pickle files importing these unblocked modules to achieve remote code execution while bypassing picklescan's safety validation entirely.
From the GitHub advisory
Summary
picklescan v1.0.3 (latest) does not block at least 7 Python standard library modules that provide direct arbitrary command execution or code evaluation. A malicious pickle file importing these modules is reported as having 0 issues (CLEAN scan). This enables remote code execution that bypasses picklescan entirely.
Severity
Critical (CVSS 9.8) — Direct RCE with zero scanner detection. Affects all deployments relying on picklescan, including HuggingFace Hub.
Affected Versions
Weakness type: CWE-184, CWE-693.
Product: picklescan (PyPI) · Assigned by: VulnCheck · Published: 2026-06-23
Affected and fixed versions
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| PyPI | picklescan | < 1.0.4 | 1.0.4 |
| Vendor | Product | Affected versions (per CVE record) |
|---|---|---|
| picklescan | picklescan | < 1.0.4 |
Severity scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| VulnCheck | 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| VulnCheck | 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- Attack vector: network (remotely reachable)
- Attack complexity: low
- Attack requirements: none
- Privileges required: none (no login)
- User interaction: none
CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.
Exploitation and urgency
- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation poc, automatable yes, technical impact total.
- FIRST EPSS (model of 2026-10-21): 1.15% probability of exploitation activity in the next 30 days; percentile 66.
Timeline
- — GitHub-reviewed advisory GHSA-g38g-8gr9-h9xp published (critical)
- — CVE record last updated
- — CVE record published by VulnCheck
Sources and references
Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.
Vendor and project advisories, patches
Vulnerability records
- GitHub Advisory GHSA-g38g-8gr9-h9xp github.com
- CVE.org record CVE-2026-56315 cve.org
- NVD entry CVE-2026-56315 nvd.nist.gov