-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| picklescan | pip | < 0.0.33 | 0.0.33 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in picklescan's failure to identify malicious functions from the numpy.f2py module within a pickle file. The root cause is an incomplete blocklist of dangerous modules and a flawed submodule check. The patch 70c1c6c31beb6baaf52c8db1b6c3c0e84a6f9dab addresses this by adding "numpy.f2py": "*" to the _unsafe_globals dictionary and refining the submodule checking logic within the _build_scan_result_from_raw_globals function in src/picklescan/scanner.py.
The function _build_scan_result_from_raw_globals is the component that consumes this blocklist to determine the safety of globals found in the pickle file. During a scan of a malicious pickle file (prior to the patch), this function would be called and would consult the incomplete _unsafe_globals list. It would not find an entry for numpy.f2py and therefore would not mark globals from this module (such as numpy.f2py.crackfortran.param_eval mentioned in the advisory) as Dangerous. This failure of detection is the vulnerability. An attacker could craft a pickle file that, when scanned, would be deemed safe, leading a user to load it and execute the embedded remote code.
Therefore, _build_scan_result_from_raw_globals is the key function that would appear in a runtime profile during the scanning phase where the vulnerability is triggered. It is the function containing the logic that fails due to the incomplete blocklist and flawed submodule check.
_build_scan_result_from_raw_globalssrc/picklescan/scanner.py