Picklescan fails to flag pip.main() as unsafe, allowing RCE bypass
Picklescan, a Python security scanner for detecting unsafe operations in pickled objects, failed to flag pip.main() as a dangerous function before version 0.0.21, allowing attackers to craft malicious pickled objects that bypass security checks and achieve remote code execution by installing arbitrary packages from PyPI or GitHub.", <parameter name="event_date">null
What happened
Picklescan before version 0.0.21 does not treat pip as an unsafe global, allowing attackers to craft malicious pickled objects that call pip.main() to install arbitrary PyPI packages while evading the scanner's security checks.
The vulnerability uses pickle's reduce method to invoke pip.main() with arguments to install a malicious package hosted on PyPI or GitHub, which then executes arbitrary code via setup.py or entry points during installation.
Reported impact
An attacker can bypass Picklescan's security checks and achieve remote code execution on systems that deserialize the malicious pickle file.
The attack enables supply chain compromise by distributing infected pickle files in machine learning models, APIs, or saved Python objects.
Index analysis
The vulnerability is classified as an incomplete list of disallowed inputs (CWE-184), allowing an unsafe function (pip.main) to escape static analysis detection.
Governance controls
Picklescan was patched by adding pip to the list of restricted globals, marking pip.main as a Dangerous operation in subsequent versions.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.