CVE-2026-53873: picklescan - Arbitrary Code Execution via profile.run() Blocklist Bypass
picklescan before 1.0.4 contains an incomplete blocklist for the profile module that fails to block the module-level profile.run() function, allowing attackers to achieve arbitrary code execution via exec(). Attackers can craft malicious pickle files calling profile.run(statement) to execute arbitrary Python code while picklescan reports zero security issues.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
picklescanto a version that resolves this vulnerability.Fixed in 1.0.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53873?
CVE-2026-53873 has a critical severity rating of 9.3.
How do I fix CVE-2026-53873?
To fix CVE-2026-53873, upgrade to picklescan version 1.0.4 or later.
What vulnerabilities does CVE-2026-53873 expose?
CVE-2026-53873 exposes the risk of arbitrary code execution through the profile.run() function.
Who is affected by CVE-2026-53873?
Users of picklescan versions prior to 1.0.4 are affected by CVE-2026-53873.
What is the impact of CVE-2026-53873?
The impact of CVE-2026-53873 allows attackers to execute arbitrary code through malicious pickle files.