VULNERABILITY INTELLIGENCE
CVE-2026-53874
CVSS score9.8 CRITICAL
EPSS probability0.52%
CISA KEVNot currently listed
Published2026-06-17
Last modified2026-06-23
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
picklescan before 1.0.1 contains an unsafe deserialization vulnerability allowing unauthenticated users to execute arbitrary code by hiding eval calls nested under callable objects via getattr. Attackers can embed malicious code in pickle files that evades detection but executes when the pickle is loaded from untrusted sources.
Weakness classification
- disclosure@vulncheck.com: CWE-502