picklescan has 51 CVEs on record between 2025 and 2026. Disclosures have slowed: 0 in the last 90 days after 44 in the 90 before. The busiest recent month was June 2026 with 44. The median CVSS is 8.1 (high), with 14 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-502 (26) and CWE-184 (10).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.1
- Publish → KEV
- —
- Last 90 days
- 0 prev 44
Weakness classes
Products
- picklescan 51
Worst active — by depth score
CVE-2025-1716Critical· 9.8picklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. An attacker could craft …66GHSA-82fg-2r99-h7v6Critical· 10.0Duplicate Advisory: PickleScan's pkgutil.resolve_name has a universal blocklist bypass55GHSA-g7vj-qw6x-g3p8Critical· 9.8Duplicate Advisory: PickleScan has multiple stdlib modules with direct RCE not in blocklist54GHSA-rmpp-8wf5-xx5qCritical· 9.8Duplicate Advisory: Picklescan vulnerable to Arbitrary File Writing54GHSA-j6c9-qvp8-699fCritical· 9.8Duplicate Advisory: picklescan missing detection by simple obfuscation of a `builtins.eval` call54
picklescan vulnerabilities
CVEs affecting picklescan, newest first. Open any entry for full detail, references, and exploit status.
51 CVEsRSS
CVE-2025-71322High· 8.8PickleScan before 0.0.33 fails to include the pty.spawn function in its unsafe globals list, allowing attackers to bypass security checks
PickleScan before 0.0.33 fails to include the pty.spawn function in its unsafe globals list, allowing attackers to bypass security checks. Malicious actors can craft pickle payloads using pty.spawn to achieve arbitrary code execution whe…
CVE-2025-71325Critical· 9.8picklescan before 0.0.27 contains a parsing logic error in the _list_globals function when handling STACK_GLOBAL opcodes, failing to track arguments in the correct range and allowing malicious pickle files to bypass detection
picklescan before 0.0.27 contains a parsing logic error in the _list_globals function when handling STACK_GLOBAL opcodes, failing to track arguments in the correct range and allowing malicious pickle files to bypass detection. Attackers …
CVE-2025-71320Critical· 9.8picklescan before 0.0.33 contains an incomplete deny-list that fails to block pydoc.locate and operator.methodcaller functions, allowing attackers to bypass security checks
picklescan before 0.0.33 contains an incomplete deny-list that fails to block pydoc.locate and operator.methodcaller functions, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle files using these u…
CVE-2025-71323Critical· 9.8picklescan before 0.0.33 fails to block the ctypes module, allowing attackers to achieve remote code execution by invoking direct syscalls and accessing raw memory
picklescan before 0.0.33 fails to block the ctypes module, allowing attackers to achieve remote code execution by invoking direct syscalls and accessing raw memory. Attackers can craft malicious pickle files using ctypes.WinDLL to load k…
GHSA-6v84-v468-3c7fCritical· 9.8Duplicate Advisory: Picklescan has Incomplete List of Disallowed Inputs
Duplicate Advisory: Picklescan has Incomplete List of Disallowed Inputs
GHSA-rmpp-8wf5-xx5qCritical· 9.8Duplicate Advisory: Picklescan vulnerable to Arbitrary File Writing
Duplicate Advisory: Picklescan vulnerable to Arbitrary File Writing
GHSA-7f79-rvx6-vxc4Critical· 9.8Duplicate Advisory: Picklescan does not block ctypes
Duplicate Advisory: Picklescan does not block ctypes
GHSA-5rph-q42j-36j9Critical· 9.8Duplicate Advisory: Picklescan has pickle parsing logic flaw that leads to malicious pickle file bypass
Duplicate Advisory: Picklescan has pickle parsing logic flaw that leads to malicious pickle file bypass
GHSA-5gp7-4733-2w2vHigh· 8.8Duplicate Advisory: Picklescan Bypasses Unsafe Globals Check using pty.spawn
Duplicate Advisory: Picklescan Bypasses Unsafe Globals Check using pty.spawn
GHSA-82fg-2r99-h7v6Critical· 10.0Duplicate Advisory: PickleScan's pkgutil.resolve_name has a universal blocklist bypass
Duplicate Advisory: PickleScan's pkgutil.resolve_name has a universal blocklist bypass
GHSA-5v23-73v4-w2fpHigh· 7.5Duplicate Advisory: picklescan has Arbitrary file read using `io.FileIO`
Duplicate Advisory: picklescan has Arbitrary file read using `io.FileIO`
GHSA-j6c9-qvp8-699fCritical· 9.8Duplicate Advisory: picklescan missing detection by simple obfuscation of a `builtins.eval` call
Duplicate Advisory: picklescan missing detection by simple obfuscation of a `builtins.eval` call
GHSA-cc5p-54x3-hcf8HighDuplicate Advisory: Picklescan (scan_pytorch) Bypass via dynamic eval MAGIC_NUMBER
Duplicate Advisory: Picklescan (scan_pytorch) Bypass via dynamic eval MAGIC_NUMBER
GHSA-4mpj-78p6-rj59Critical· 9.8Duplicate Advisory: PickleScan's profile.run blocklist mismatch allows exec() bypass
Duplicate Advisory: PickleScan's profile.run blocklist mismatch allows exec() bypass
CVE-2026-56315Critical· 9.8PickleScan has multiple stdlib modules with direct RCE not in blocklist
PickleScan has multiple stdlib modules with direct RCE not in blocklist
CVE-2026-53875HighPicklescan (scan_pytorch) Bypass via dynamic eval MAGIC_NUMBER
Picklescan (scan_pytorch) Bypass via dynamic eval MAGIC_NUMBER
CVE-2026-56304Mediumpicklescan vulnerable to arbitrary file create using logging.FileHandler
picklescan vulnerable to arbitrary file create using logging.FileHandler
CVE-2026-53874Highpicklescan missing detection by simple obfuscation of a `builtins.eval` call
picklescan missing detection by simple obfuscation of a `builtins.eval` call
CVE-2026-53872High· 7.5picklescan has Arbitrary file read using `io.FileIO`
picklescan has Arbitrary file read using `io.FileIO`
CVE-2025-46417HighPicklescan Vulnerable to Exfiltration via DNS via linecache and ssl.get_server_certificate
Picklescan Vulnerable to Exfiltration via DNS via linecache and ssl.get_server_certificate
CVE-2025-1716Critical· 9.8PoCpicklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. An attacker could craft …
picklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. An attacker could craft a malicious model that uses Pickle and include a malicious pickle file with a non-standard file exte…