CVE-2026-53874

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 1.0.1

Description An unsafe deserialization issue allows unauthenticated users to execute arbitrary code on a host that loads a pickle payload from an untrusted source. This is achieved by hiding eval calls nested under callable objects using the getattr function. Attackers can embed malicious code within pickle files that evades detection by the software but executes upon loading, potentially facilitating supply chain attacks against systems loading serialized ML models, APIs, or saved Python objects.

Recommendations Update to version 1.0.1 or later.