Critical severityNVD Advisory· Published Jun 17, 2026· Updated Jun 17, 2026
picklescan - Arbitrary Code Execution via profile.run() Blocklist Bypass
CVE-2026-53873
Description
picklescan before 1.0.4 contains an incomplete blocklist for the profile module that fails to block the module-level profile.run() function, allowing attackers to achieve arbitrary code execution via exec(). Attackers can craft malicious pickle files calling profile.run(statement) to execute arbitrary Python code while picklescan reports zero security issues.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
picklescanPyPI | < 1.0.4 | 1.0.4 |
Affected products
1- Range: <1.0.4
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-7wx9-6375-f5whghsaADVISORY
- github.com/mmaitre314/picklescan/security/advisories/GHSA-7wx9-6375-f5whghsavendor-advisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-53873ghsaADVISORY
- www.vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-profile-run-blocklist-bypassghsathird-party-advisoryWEB
News mentions
0No linked articles in our index yet.