Critical Vulnerabilities Discovered in PickleScan Security Scanner

Two critical vulnerabilities have been identified in PickleScan, a Python security scanner for serialized objects, affecting its blocklist-based protection. The first vulnerability (GHSA-g38g-8gr9-h9xp, CVSS 9.8) reveals six Python standard library modules that allow remote code execution but are not included in PickleScan's blocklist. The second vulnerability (GHSA-vvpj-8cmc-gx39, CVSS 10.0) enables a universal blocklist bypass via pkgutil.resolve_name, allowing attackers to invoke any callable in Python's runtime. Organizations using PickleScan for model safety, particularly on platforms like HuggingFace Hub, may have been misled into believing their models were safe. It is recommended that users upgrade to version 1.0.4 or later and audit previously scanned models. The vulnerabilities highlight the inadequacy of relying solely on blocklist-based scanning for security. Immediate action is required to mitigate potential risks of remote code execution.

Key Points: • Two critical vulnerabilities in PickleScan compromise its blocklist protection. • The first vulnerability allows RCE via unblocked Python modules; the second enables universal bypass. • Organizations must upgrade to version 1.0.4 and re-evaluate previously scanned models.