VULNERABILITY INTELLIGENCE
CVE-2026-53873
CVSS score9.8 CRITICAL
EPSS probability0.46%
CISA KEVNot currently listed
Published2026-06-17
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
picklescan before 1.0.4 contains an incomplete blocklist for the profile module that fails to block the module-level profile.run() function, allowing attackers to achieve arbitrary code execution via exec(). Attackers can craft malicious pickle files calling profile.run(statement) to execute arbitrary Python code while picklescan reports zero security issues.
Weakness classification
- disclosure@vulncheck.com: CWE-184