Description
picklescan before 1.0.3 contains a scanning bypass vulnerability in the scan_pytorch function that allows attackers to embed malicious magic numbers via dynamic eval using the __reduce__ trick. Attackers can craft malicious PyTorch payloads that evade picklescan detection while remaining executable, enabling arbitrary code execution when loaded with torch.load().
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
picklescan picklescan
Default version status: unaffected
0 to < 1.0.3affected1.0.3unaffected
pkg:pypi/picklescanReferences
- https://github.com/mmaitre314/picklescan/security/advisories/GHSA-97f8-7cmv-76j2 ↗
- https://github.com/mmaitre314/picklescan/commit/2a8383cfeb4158567f9770d86597300c9e508d0f ↗
- https://github.com/mmaitre314/picklescan/commit/134179474539648ba7dee1317959529fbd0e7f89 ↗
- https://www.vulncheck.com/advisories/picklescan-scanning-bypass-via-dynamic-eval-in-scan-pytorch ↗