VULNERABILITY INTELLIGENCE
CVE-2026-53875
CVSS score7.1 HIGH
EPSS probability0.55%
CISA KEVNot currently listed
Published2026-06-17
Last modified2026-10-26
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Description
picklescan before 1.0.3 contains a scanning bypass vulnerability in the scan_pytorch function that allows attackers to embed malicious magic numbers via dynamic eval using the __reduce__ trick. Attackers can craft malicious PyTorch payloads that evade picklescan detection while remaining executable, enabling arbitrary code execution when loaded with torch.load().
Weakness classification
- CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')