Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Picklescan before 0.0.28 may miss malicious torch code

published 4 months ago

Summary

Picklescan versions earlier than 0.0.28 do not recognize dangerous calls to the torch.jit.unsupported_tensor_ops.execWrapper function that can be hidden inside pickle files. If such a file is loaded with pickle.load(), the hidden code can run on the system. Upgrade Picklescan to version 0.0.28 or later, or use alternative scanning tools that detect these calls.

What to do

Update matthieu maitre picklescan to version 0.0.28.

Affected software

Ecosystem	Vendor	Product	Affected versions
PyPI	matthieu maitre	picklescan	< 0.0.28 Fix: upgrade to 0.0.28

Original advisory text

Duplicate Advisory: Picklescan missing detection when calling pytorch function torch.jit.unsupported_tensor_ops.execWrapper

### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-vr7h-p6mm-wpmh. This link is maintained to preserve external references.

### Original Description
picklescan before 0.0.28 fails to detect malicious torch.jit.unsupported_tensor_ops.execWrapper function calls embedded in pickle files. Attackers can craft malicious pickle files that bypass picklescan detection and execute arbitrary code when loaded via pickle.load().

References

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

9.1 Critical

Type

CWE-502Deserialization of Untrusted Data

Timeline

Published23 Jun 2026

Updated30 Sep 2026

First seen30 Sep 2026

Sources

GHSA-q8qp-8jq6-78mc · OSV

Track software like this

Free during beta