Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| picklescan | pip | < 0.0.35 | 0.0.35 |
Miggo AIRoot Cause AnalysisThe vulnerability is a bypass in the picklescan security scanner, which failed to detect an arbitrary file read and Server-Side Request Forgery (SSRF) vulnerability in applications that deserialize untrusted pickle data. The root cause of the underlying vulnerability in an application is the unsafe deserialization of data with pickle.
The exploit chain involves two key Python standard library functions:
io.FileIO: This function is used to open and read arbitrary files on the server, bypassing blocklists that may be in place for the built-in open function.urllib.request.urlopen: This function is then used to send the content of the read file to an external, attacker-controlled server, effectively exfiltrating the data.The patch for picklescan (commit a01c58d5dd7960db557b849817c0ab83ab111ef1) addresses this detection gap by adding _io.FileIO (which is how io.FileIO is represented internally) and urllib.request.urlopen to its list of dangerous globals. This allows picklescan to identify pickle files that use these functions to perform malicious actions.
Therefore, during an exploit of a vulnerable application, io.FileIO and urllib.request.urlopen would appear in a runtime profile or stack trace.
io.FileIOsrc/picklescan/scanner.py
urllib.request.urlopensrc/picklescan/scanner.py