CVE-2026-3490: picklescan - Universal Blocklist Bypass via pkgutil.resolve_name

Synopsis

A universal blocklist bypass vulnerability exists in picklescan before version 1.0.4. The library, which scans Python pickle files for dangerous opcodes, fails to block pkgutil.resolve_name, allowing any attacker who can supply a malicious pickle file to resolve and invoke blocked functions such as os.system, builtins.exec, or subprocess.call through indirect REDUCE calls. This bypass requires no authentication and is reachable over the network, leading directly to remote code execution on any host that processes the malicious file. A patched-image rebuild at version 1.0.4 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the service over the network and deliver a crafted pickle payload to any endpoint that processes pickle files using picklescan.

• AuthenticationNot required

  No credentials or account are needed; any unauthenticated party who can submit or upload a pickle file can trigger the bypass.

• Victim interactionNot required

  No user action is required; the vulnerable code path executes automatically when the application processes the malicious pickle file.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, memory layout dependencies, or environmental factors need to be satisfied.

Blast Radius

• The attacker executes arbitrary system commands on the host running picklescan, gaining full code execution at the process privilege level.
• Confidential data accessible to the process, including environment variables, secrets, and filesystem contents, is directly readable by the attacker.
• The attacker can write, overwrite, or delete files and modify application state on the host.
• In containerized environments, a successful exploit can be used as a stepping stone to read mounted secrets or reach adjacent services within the same pod or network namespace.