Back to overview

CVE-2026-53874

CRITICAL
9.8
CVSS 3.1
Description
picklescan before 1.0.1 contains an unsafe deserialization vulnerability allowing unauthenticated users to execute arbitrary code by hiding eval calls nested under callable objects via getattr. Attackers can embed malicious code in pickle files that evades detection but executes when the pickle is loaded from untrusted sources.

Metadata

CVE ID
CVE-2026-53874
State
PUBLISHED
Assigner
VulnCheck
Reserved
2026-06-10 21:23 UTC
Published
2026-06-17 15:05 UTC
Last updated
2026-06-17 15:05 UTC
Primary CWE
CWE-502
Deserialization of Untrusted Data
Vendor / Product
picklescan / picklescan
Sources
cve.org  ·  NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products (1)
VendorProductPlatformVersions
picklescan picklescan — 0 < 1.0.1, 1.0.1
Weakness (CWE)
CWESourceDescription
CWE-502 cna Deserialization of Untrusted Data
CVSS scores (2)
ScoreSeverityVersionSourceVector
9.8 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3 CRITICAL 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References (2)
Back to overview