CVE-2026-53874: picklescan - Arbitrary Code Execution via Obfuscated eval Call
picklescan before 1.0.1 contains an unsafe deserialization vulnerability allowing unauthenticated users to execute arbitrary code by hiding eval calls nested under callable objects via getattr. Attackers can embed malicious code in pickle files that evades detection but executes when the pickle is loaded from untrusted sources.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
picklescanto a version that resolves this vulnerability.Fixed in 1.0.1 - Compensating control
Do not load or deserialize pickle files from untrusted sources. If you must process pickles from external or untrusted origins, handle them only within isolated/sandboxed environments (e.g., containers, VMs) or block such inputs at application boundaries.
- Operational
Audit code and systems for usages of pickle.load / pickle.loads or other pickle deserialization of external input. Remove or refactor code that deserializes untrusted pickle data, or ensure inputs are fully trusted before deserialization. Deploy the fixed picklescan 1.0.1 where used.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53874?
CVE-2026-53874 has a critical severity rating of 9.3.
How do I fix CVE-2026-53874?
To fix CVE-2026-53874, upgrade to picklescan version 1.0.1 or later.
What type of vulnerability is CVE-2026-53874?
CVE-2026-53874 is an arbitrary code execution vulnerability due to unsafe deserialization.
Who can exploit CVE-2026-53874?
CVE-2026-53874 can be exploited by unauthenticated users.
What impact does CVE-2026-53874 have on my system?
CVE-2026-53874 allows attackers to execute arbitrary code, potentially compromising system integrity.