CVE-2026-53872: picklescan Unsafe Deserialization – File Exfiltration Vulnerability

Technical summary

CVE-2026-53872 is an unsafe deserialization vulnerability in picklescan before version 0.0.35. The root cause is improper validation of pickle opcodes during deserialization. Attackers craft pickled Python objects that leverage io.FileIO for file read access and urllib.request.urlopen for network communication, allowing them to exfiltrate arbitrary files from the affected system. The attack chains these library calls in a way that circumvents existing RCE-focused blocklists that may permit individual library access but fail to detect dangerous combinations. The vulnerability is network-accessible, requires no credentials, and has no user interaction requirement, resulting in a CVSS 3.1 score of 7.5 (HIGH).

Business impact

Organizations using picklescan to validate or deserialize untrusted pickle data face a direct risk of sensitive file disclosure. If an application processes user-supplied pickled objects—common in data serialization, message queuing, or machine learning pipelines—attackers can extract configuration files, secrets, API keys, database credentials, or other sensitive data stored on the server. This exposure can lead to lateral movement, privilege escalation, or secondary compromises. The lack of authentication requirements means any network-reachable instance is at risk.

Affected systems

picklescan versions prior to 0.0.35 are vulnerable. The project is used in environments where pickle validation or deserialization of untrusted data is necessary. This includes machine learning model serving platforms, data serialization frameworks, and security tools that rely on picklescan for malicious pickle detection. Any deployment processing pickled data from untrusted sources (user uploads, third-party APIs, message queues) running vulnerable versions is affected.

Exploitability

This vulnerability is straightforward to exploit. An attacker needs only to craft a valid pickled Python object combining io.FileIO and urllib.request.urlopen—no complex gadget chains or rare library dependencies required. The attack is network-accessible with no authentication barrier. The primary complexity is that existing defenses may focus on blocking individual RCE libraries while missing the dangerous cross-library interaction this CVE exploits. Public exploit tooling or proof-of-concept code demonstrating this technique may emerge as awareness spreads.

Remediation

Upgrade picklescan to version 0.0.35 or later. Verify the upgrade in your environment and confirm that pickle validation is functioning as expected. As an interim measure, if immediate patching is not feasible, restrict network access to systems processing untrusted pickle data, disable pickle deserialization if alternatives exist, or implement strict allowlisting of pickle sources. Avoid deserializing pickled data from untrusted origins whenever possible.

Patch guidance

Update picklescan to version 0.0.35 or later via your package manager (pip install picklescan --upgrade). Confirm the update by checking the installed version and re-running your pickle validation workflows. Test in a staging environment before production deployment. Review your dependency tree to identify all services and tools that depend on picklescan and prioritize patching those in direct contact with untrusted data.

Detection guidance

Monitor for pickle deserialization attempts on your network, particularly those involving urllib or file I/O operations in the deserialized object chain. Log and alert on any pickle processing warnings or errors from picklescan. Check package inventory to identify systems running picklescan versions prior to 0.0.35. If you have forensic access, look for unusual file read patterns (e.g., io.FileIO objects in serialized data) and outbound network connections coinciding with pickle processing. Network-level detection is difficult since the attack occurs during deserialization; focus on inventory and access control.

Why prioritize this

This vulnerability warrants HIGH priority patching. The CVSS 7.5 score reflects high confidentiality impact (C:H) with no authentication requirement, network accessibility, and low attack complexity. While data exfiltration rather than RCE, it directly enables sensitive information disclosure. Any organization running picklescan on systems with access to sensitive files should patch immediately. The vulnerability is not yet in the KEV catalog, but that is not an indication of low risk—exploitation is straightforward and requires no special tools.

Risk score, explained

CVSS 3.1 score of 7.5 (HIGH) reflects: Attack Vector Network (AV:N) — exploitable remotely without physical access. Attack Complexity Low (AC:L) — no special conditions needed to exploit. Privileges Required None (PR:N) — unauthenticated access is sufficient. User Interaction None (UI:N) — no user action needed. Scope Unchanged (S:U) — impact limited to the affected service. Confidentiality High (C:H) — arbitrary file read access. Integrity None (I:N) — no data modification. Availability None (A:N) — no denial of service. The confidentiality impact and lack of barriers to exploitation drive the HIGH severity.

Frequently asked questions