CVE-2026-53873CWE-184

picklescan - Arbitrary Code Execution via profile.run() Blocklist Bypass

Critical · published June 17, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
51.4
In the wild
Unconfirmed
What it is

picklescan before 1.0.4 contains an incomplete blocklist for the profile module that fails to block the module-level profile.run() function, allowing attackers to achieve arbitrary code execution via exec(). Attackers can craft malicious pickle files calling profile.run(statement) to execute arbitrary Python code while picklescan reports zero security issues.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00671 · 51.4th percentile
Weakness
CWE-184 · Incomplete List of Disallowed Inputs
Published
2026-06-17T15:05Z
EPSS history
Timeline
  • 17 JUN 15:05Z
    picklescan - Arbitrary Code Execution via profile.run() Blocklist Bypass
    cvelistv5