N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-p9w7-82w4-7q8m

GHSA-p9w7-82w4-7q8m: Picklescan is missing detection when calling built-in python lib2to3.pgen2.pgen.ParserGenerator.make_label

Summary

Using lib2to3.pgen2.pgen.ParserGenerator.make_label function, which is a built-in python library function to execute remote pickle file.

Details

The attack payload executes in the following steps:

First, the attacker craft the payload by calling to lib2to3.pgen2.pgen.ParserGenerator.make_label function in reduce method Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution.

PoC

from types import SimpleNamespace
from lib2to3.pgen2.pgen import ParserGenerator

class EvilLib2to3Pgen2ParserGeneratorMakeLabel:
    def __reduce__(self):
        c = SimpleNamespace(labels=[], keywords={}, tokens={})
        label = '""+__import__(\'os\').system(\'whoami\')'
        return ParserGenerator.make_label, (None, c, label)

Impact

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models. What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded. Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

Corresponding

https://github.com/FredericDT https://github.com/Qhaoduoyu

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-p9w7-82w4-7q8m

GHSA-p9w7-82w4-7q8m:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
picklescan	pip	< 0.0.30	0.0.30

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability GHSA-p9w7-82w4-7q8m lies in the picklescan library's failure to detect a malicious pickle payload that uses the lib2to3.pgen2.pgen.ParserGenerator.make_label function. This function, part of Python's standard library, can be leveraged to execute arbitrary code.

The root cause of the vulnerability in picklescan is an incomplete blocklist of dangerous functions. The library maintains a dictionary of known dangerous globals (dangerous_globals in src/picklescan/scanner.py) that should not be present in a safe pickle file. Before the patch, lib2to3.pgen2.pgen.ParserGenerator.make_label was not on this list.

An attacker can create a pickle file that, when loaded by pickle.load(), will execute the __reduce__ method of a specially crafted class. This __reduce__ method can be designed to return the ParserGenerator.make_label function and arguments that form a malicious command. When pickle.load() processes this, it executes the function, leading to remote code execution.

The provided patch addresses this by adding lib2to3.pgen2.pgen.ParserGenerator.make_label to the dangerous_globals dictionary in src/picklescan/scanner.py. This ensures that picklescan will now correctly identify pickle files attempting to use this function and flag them as malicious.

Therefore, for a security engineer, the key runtime indicator of an attempted exploit of this vulnerability would be the execution of the lib2to3.pgen2.pgen.ParserGenerator.make_label function originating from a pickle.load() operation. While the vulnerability is in picklescan, the function to monitor for during an active exploit is the one from the standard library.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-p9w7-82w4-7q8m: Picklescan is missing detection when calling built-in python lib2to3.pgen2.pgen.ParserGenerator.make_label

Summary

Details

PoC

Impact

Corresponding

GHSA-p9w7-82w4-7q8m:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

GHSA-p9w7-82w4-7q8m: Picklescan is missing detection when calling built-in python lib2to3.pgen2.pgen.ParserGenerator.make_label

Summary

Details

PoC

Impact

Corresponding

N/A

N/A

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI