Arbitrary Code Execution Vulnerability in picklescan by Maitre314

CVE-2026-53873

What is CVE-2026-53873?

The picklescan tool, prior to version 1.0.4, contains an incomplete blocklist for its profile module, which neglected to restrict the execution of the profile.run() function. This oversight allows attackers to create malicious pickle files capable of executing arbitrary Python code through a crafted call to profile.run(statement). As a result, while picklescan may report no security issues, it leaves systems vulnerable to significant security threats through arbitrary code execution.

References