CVE-2026-53873

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 1.0.4

Description An incomplete blocklist for the profile module fails to block the module-level profile.run() function. This allows attackers to achieve arbitrary code execution via exec() by crafting malicious pickle files that call profile.run(statement). The issue occurs because the scanner performs an exact string comparison and the blocklist entry Profile.run does not match the pickle global name run. Consequently, the scanner reports zero security issues while the payload executes arbitrary Python code.

Recommendations Update to version 1.0.4 or later. As a temporary workaround, restrict the processing of untrusted pickle files until the update is applied.