CVE-2026-53875 — picklescan - Scanning Bypass via Dynamic Eval in scan_pytorch
picklescan before 1.0.3 contains a scanning bypass vulnerability in the scan_pytorch function that allows attackers to embed malicious magic numbers via dynamic eval using the _…
Published: 2026-06-17 · CVSS: 7.1 · CVSS 4.0
picklescan before 1.0.3 contains a scanning bypass vulnerability in the scan_pytorch function that allows attackers to embed malicious magic numbers via dynamic eval using the __reduce__ trick. Attackers can craft malicious PyTorch payloads that evade picklescan detection while remaining executable, enabling arbitrary code execution when loaded with torch.load().
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7