GHSA-f745-w6jp-hpxx: picklescan: RCE bypass via torch.utils.collect_env

### Summary Using torch.utils.collect_env.run function, which is a pytorch library function to execute remote pickle file. ### Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to torch.utils.collect_env.run function in reduce method Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution. ### PoC ``` import torch.utils.collect_env as collect_env class EvilTorchUtilsCollectEnvRun: def __reduce__(self): command = 'touch /tmp/collect_env_run_success' return collect_env.run, (command,) ``` ### Impact Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models. What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded. Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects. ### Corresponding https://github.com/FredericDT https://github.com/Qhaoduoyu

Attacker publishes a PyTorch model on HuggingFace or a private artifact registry, embedding a payload via torch.utils.collect_env.run in the pickle __reduce__ method — the payload executes an arbitrary OS command (reverse shell, credential harvester, cryptominer). The victim organization's MLOps pipeline downloads the model as part of fine-tuning or evaluation workflow, runs picklescan which returns clean, and proceeds to torch.load() the file. The payload executes with the privileges of the ML worker process, which in AWS SageMaker or GCP Vertex AI typically has an IAM role with S3/GCS read access, potentially exposing training datasets, model weights, and environment secrets.