Unsafe Deserialization Vulnerability in Picklescan by Mmaitre314

CVE-2026-53874

What is CVE-2026-53874?

The Picklescan library prior to version 1.0.1 is vulnerable to an unsafe deserialization flaw that permits unauthenticated adversaries to execute arbitrary code. This vulnerability arises when malicious code is embedded in pickle files that can evade detection, yet become executable when the affected library processes these pickle files from untrusted origins. This scenario is particularly concerning as it exploits nested eval calls hidden within callable objects, enabling attackers to execute harmful actions remotely without requiring user authentication.

References