CVE-2026-53874

CRITICAL EPSS 40.2%

Published Jun 17, 20261w ago · Modified Jun 23, 20261w ago

9.3 CVSS 4.0

Critical

Published Jun 17, 2026 1w ago

Last Modified Jun 23, 2026 1w ago

Description

picklescan before 1.0.1 contains an unsafe deserialization vulnerability allowing unauthenticated users to execute arbitrary code by hiding eval calls nested under callable objects via getattr. Attackers can embed malicious code in pickle files that evades detection but executes when the pickle is loaded from untrusted sources.

CVSS Details

Base Score

9.3

Exploitability

—

Impact

—

Vector string

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope X

Threat Intelligence

EPSS Exploit Probability

40.2% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-502 Deserialization of Untrusted Data Validation

References 2

github.com https://github.com/mmaitre314/picklescan/security/advisories/GHSA-9m3x-qqw2-h32h
vulncheck.com https://www.vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-obfuscated-eval-call

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.