Executive Summary

The vulnerability in picklescan versions through 0.0.26 involves a failure to detect malicious pickle files that use the idlelib.pyshell.ModifiedInterpreter.runcode method within their __reduce__ methods. This allows attackers to embed code in pickle files that executes arbitrary commands when the file is loaded using pickle.load().

This flaw enables supply chain attacks on PyTorch models and saved Python objects by allowing undetected malicious code execution during the deserialization process.

The issue is fixed in picklescan version 0.0.30.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to arbitrary code execution when loading malicious pickle files, which can compromise the security of systems using picklescan to scan PyTorch models or saved Python objects.

Attackers can exploit this to perform supply chain attacks, potentially leading to unauthorized actions, data breaches, or system compromise.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade picklescan to version 0.0.30 or later, where the issue is fixed.

Useful 0 Not Useful 0