Picklescan has a missing detection when calling built-in python profile.Profile.runctx
### Summary Using profile.Profile.runctx, which is a built-in python library function to execute remote pickle file. ### Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to profile.Profile.runctx function in reduce method Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution. ### PoC ``` class EvilProfileRunctx: def __reduce__(self): from profile import Profile payload = "__import__('os').system('whoami')" return Profile.runctx, (Profile(), payload, {}, {}) ``` ### Impact Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models. What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded. Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects. ### Corresponding https://github.com/FredericDT https://github.com/Qhaoduoyu
PYSEC-2026-4132
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:PYSEC-2026-4132
picklescan
Source reference: /affected/0/package/name
- Affected versions
- 0.0.1
Source reference:
/affected/0/versions0.0.10Source reference:
/affected/0/versions0.0.11Source reference:
/affected/0/versions0.0.12Source reference:
/affected/0/versions0.0.13Source reference:
/affected/0/versions0.0.14Source reference:
/affected/0/versions0.0.15Source reference:
/affected/0/versions0.0.16Source reference:
/affected/0/versions0.0.17Source reference:
/affected/0/versions0.0.18Source reference:
/affected/0/versions0.0.19Source reference:
/affected/0/versions0.0.2Source reference:
/affected/0/versions0.0.20Source reference:
/affected/0/versions0.0.21Source reference:
/affected/0/versions0.0.22Source reference:
/affected/0/versions0.0.23Source reference:
/affected/0/versions0.0.24Source reference:
/affected/0/versions0.0.25Source reference:
/affected/0/versions0.0.26Source reference:
/affected/0/versions0.0.27Source reference:
/affected/0/versions0.0.28Source reference:
/affected/0/versions0.0.3Source reference:
/affected/0/versions0.0.4Source reference:
/affected/0/versions0.0.5Source reference:
/affected/0/versions0.0.6Source reference:
/affected/0/versions0.0.7Source reference:
/affected/0/versions0.0.8Source reference:
/affected/0/versions0.0.9Source reference:
/affected/0/versions - Fixed versions
- 0.0.29
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.29"
}
]
}
],
"package": {
"name": "picklescan",
"purl": "pkg:pypi/picklescan",
"ecosystem": "PyPI"
},
"versions": [
"0.0.1",
"0.0.10",
"0.0.11",
"0.0.12",
"0.0.13",
"0.0.14",
"0.0.15",
"0.0.16",
"0.0.17",
"0.0.18",
"0.0.19",
"0.0.2",
"0.0.20",
"0.0.21",
"0.0.22",
"0.0.23",
"0.0.24",
"0.0.25",
"0.0.26",
"0.0.27",
"0.0.28",
"0.0.3",
"0.0.4",
"0.0.5",
"0.0.6",
"0.0.7",
"0.0.8",
"0.0.9"
],
"database_specific": {
"source": "https://github.com/pypa/advisory-database/blob/main/vulns/picklescan/PYSEC-2026-4132.yaml"
}
}
]- Related CVEs
- CVE-2025-71341
Source reference:
/aliases
Publisher severity
No explicit severity was provided.
- Event
- #62497 · Revision 1
- Added to Heist Feed
- Publisher date