CVE-2026-53872

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 0.0.35

Description Unsafe pickle deserialization allows unauthenticated attackers to read arbitrary server files and perform Server-Side Request Forgery (SSRF). The issue occurs because the application deserializes untrusted pickle data. Attackers can bypass blocklists designed to prevent Remote Code Execution (RCE) by chaining the io.FileIO function to open local files and the urllib.request.urlopen function to stream the file content as a POST request body to an external server. This allows for the exfiltration of sensitive data, such as /etc/passwd.

Recommendations Update to version 0.0.35 or later.