CVE-2026-53874: picklescan scanner bypass enables

Q: Is CVE-2026-53874 actively exploited?

No confirmed active exploitation of CVE-2026-53874 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-53874?

1. Upgrade picklescan to 1.0.1 immediately — this is the only complete remediation. 2. Until patched, treat all pickle files as untrusted regardless of scan result; quarantine files scanned with picklescan < 1.0.1 and re-scan with the patched version. 3. Migrate model serialization to safetensors format where feasible — this eliminates the pickle code-execution attack surface entirely for model weights. 4. Audit model registries and dataset stores for recently ingested pickle files that passed prior scans; prioritize files from external or third-party sources. 5. Add network egress controls on training and inference nodes to limit post-exploitation lateral movement and data exfiltration. 6. Monitor ML workloads for anomalous process spawning, unexpected outbound connections, or credential access patterns as post-exploitation detection signals.

Q: What systems are affected by CVE-2026-53874?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, model serving, model registries, MLOps workflows, data ingestion pipelines.

Q: What is the CVSS score for CVE-2026-53874?

CVE-2026-53874 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.52%.

CISO Take

picklescan, the primary open-source scanner used to gate pickle files in AI/ML pipelines, contains a critical evasion vulnerability: attackers can hide malicious eval calls nested inside callable objects accessed via getattr, bypassing detection entirely and receiving a false 'clean' verdict. The blast radius is highest for teams that treat a passing picklescan result as authorization to load a pickle file — this CVE inverts that trust relationship entirely, meaning every pickle artifact marked safe by versions below 1.0.1 must now be considered unverified. Despite only 3 direct downstream dependents tracked in package metadata, picklescan is broadly deployed as a defense-in-depth control across model registries, training pipelines, and dataset ingestion workflows that far exceed what dependency graphs capture. No public exploit exists yet, but the CVSS 9.8 / AV:N/AC:L/PR:N/UI:N profile means weaponization requires minimal skill once the bypass technique — already documented in the advisory — is known. Upgrade to picklescan 1.0.1 immediately, quarantine all pickle files scanned with prior versions, and migrate model serialization to safetensors format to eliminate the pickle attack surface permanently.

Sources: NVD GitHub Advisory VulnCheck ATLAS

What is the risk?

Critical severity compounded by a false-sense-of-security multiplier: organizations relying on picklescan as their primary pickle defense now have an undetected gap in a control they believe is functioning. CVSS 9.8 with maximum exploitability (network-reachable, low complexity, no authentication, no user interaction beyond loading the file) leaves almost no friction between attacker and RCE. The 68 prior CVEs in the same package signal a historically under-maintained codebase with recurring security debt. Absence from CISA KEV and lack of a public exploit provide a narrow remediation window before weaponization.

How does the attack unfold?

Craft Malicious Artifact

Attacker constructs a pickle file embedding an eval-based payload inside a callable object accessed via getattr, a structure that executes arbitrary code on deserialization but evades picklescan's pattern matching.

AML.T0018.002

Scanner Evasion

The crafted pickle file is submitted to the victim pipeline; picklescan < 1.0.1 fails to detect the obfuscated eval call and returns a clean verdict, granting the file trusted status.

AML.T0107

Artifact Ingestion

The falsely-cleared pickle file is admitted into the model registry, dataset store, or CI/CD artifact cache and awaits loading by the target ML runtime.

AML.T0011.000

Remote Code Execution

A training job or inference service calls pickle.load() on the malicious artifact, triggering the embedded eval and granting the attacker arbitrary code execution with the ML process's privileges.

AML.T0050

Craft Malicious Artifact

Attacker constructs a pickle file embedding an eval-based payload inside a callable object accessed via getattr, a structure that executes arbitrary code on deserialization but evades picklescan's pattern matching.

AML.T0018.002

Scanner Evasion

The crafted pickle file is submitted to the victim pipeline; picklescan < 1.0.1 fails to detect the obfuscated eval call and returns a clean verdict, granting the file trusted status.

AML.T0107

Artifact Ingestion

The falsely-cleared pickle file is admitted into the model registry, dataset store, or CI/CD artifact cache and awaits loading by the target ML runtime.

AML.T0011.000

Remote Code Execution

A training job or inference service calls pickle.load() on the malicious artifact, triggering the embedded eval and granting the attacker arbitrary code execution with the ML process's privileges.

AML.T0050

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
picklescan	pip	—	No patch
420 3 dependents Pushed 9d ago 53% patched ~12d to patch Full package profile →

Do you use picklescan? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 41% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

6 steps

Upgrade picklescan to 1.0.1 immediately — this is the only complete remediation.
Until patched, treat all pickle files as untrusted regardless of scan result; quarantine files scanned with picklescan < 1.0.1 and re-scan with the patched version.
Migrate model serialization to safetensors format where feasible — this eliminates the pickle code-execution attack surface entirely for model weights.
Audit model registries and dataset stores for recently ingested pickle files that passed prior scans; prioritize files from external or third-party sources.
Add network egress controls on training and inference nodes to limit post-exploitation lateral movement and data exfiltration.
Monitor ML workloads for anomalous process spawning, unexpected outbound connections, or credential access patterns as post-exploitation detection signals.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Code Execution Model Framework AML.T0010.001 - AI Software AML.T0011.000 - Unsafe AI Artifacts AML.T0018.002 - Embed Malware AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

8.4 - AI system risk assessment and treatment

NIST AI RMF

MS-2.5 - AI Risk Measurement — Testing and Evaluation

OWASP LLM Top 10

LLM05:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-53874?

picklescan, the primary open-source scanner used to gate pickle files in AI/ML pipelines, contains a critical evasion vulnerability: attackers can hide malicious eval calls nested inside callable objects accessed via getattr, bypassing detection entirely and receiving a false 'clean' verdict. The blast radius is highest for teams that treat a passing picklescan result as authorization to load a pickle file — this CVE inverts that trust relationship entirely, meaning every pickle artifact marked safe by versions below 1.0.1 must now be considered unverified. Despite only 3 direct downstream dependents tracked in package metadata, picklescan is broadly deployed as a defense-in-depth control across model registries, training pipelines, and dataset ingestion workflows that far exceed what dependency graphs capture. No public exploit exists yet, but the CVSS 9.8 / AV:N/AC:L/PR:N/UI:N profile means weaponization requires minimal skill once the bypass technique — already documented in the advisory — is known. Upgrade to picklescan 1.0.1 immediately, quarantine all pickle files scanned with prior versions, and migrate model serialization to safetensors format to eliminate the pickle attack surface permanently.

Is CVE-2026-53874 actively exploited?

No confirmed active exploitation of CVE-2026-53874 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-53874?

1. Upgrade picklescan to 1.0.1 immediately — this is the only complete remediation. 2. Until patched, treat all pickle files as untrusted regardless of scan result; quarantine files scanned with picklescan < 1.0.1 and re-scan with the patched version. 3. Migrate model serialization to safetensors format where feasible — this eliminates the pickle code-execution attack surface entirely for model weights. 4. Audit model registries and dataset stores for recently ingested pickle files that passed prior scans; prioritize files from external or third-party sources. 5. Add network egress controls on training and inference nodes to limit post-exploitation lateral movement and data exfiltration. 6. Monitor ML workloads for anomalous process spawning, unexpected outbound connections, or credential access patterns as post-exploitation detection signals.

What systems are affected by CVE-2026-53874?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, model serving, model registries, MLOps workflows, data ingestion pipelines.

What is the CVSS score for CVE-2026-53874?

CVE-2026-53874 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.52%.

What is the AI security impact?

Affected AI Architectures

training pipelinesmodel servingmodel registriesMLOps workflowsdata ingestion pipelines

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0011.000 Unsafe AI Artifacts

AML.T0018.002 Embed Malware

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: 8.4

NIST AI RMF: MS-2.5

OWASP LLM Top 10: LLM05:2025

What are the technical details?

Original Advisory

picklescan before 1.0.1 contains an unsafe deserialization vulnerability allowing unauthenticated users to execute arbitrary code by hiding eval calls nested under callable objects via getattr. Attackers can embed malicious code in pickle files that evades detection but executes when the pickle is loaded from untrusted sources.

Exploitation Scenario

An adversary targeting an organization's ML pipeline crafts a pickle file containing an obfuscated eval payload — specifically wrapping the malicious code in a callable object and accessing it via getattr to defeat picklescan's signature-based detection. They upload the file to a public model hub posing as a fine-tuned model, or deliver it directly via a phishing campaign targeting an ML engineer. The victim's CI/CD pipeline runs picklescan, which returns a clean verdict. The artifact is promoted to the model registry and eventually loaded by a training job or inference service via pickle.load(), triggering the embedded eval. The attacker gains RCE with the privileges of the ML runtime process — often a service account with access to cloud storage, secrets managers, and GPU cluster APIs — enabling credential theft, data exfiltration, or persistent backdoor installation.

Weaknesses (CWE)

CWE-502 Deserialization of Untrusted Data Primary CWE-502 Deserialization of Untrusted Data

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.