CVE-2026-53875: picklescan - Scanning Bypass via Dynamic Eval in scan_pytorch

Synopsis

A scanning-bypass vulnerability in picklescan (versions before 1.0.3) allows an attacker to craft a malicious PyTorch model file that slips past picklescan's detection logic. The attack is network-reachable, requires no authentication, and needs a user to load the crafted file. Successful exploitation results in arbitrary code execution when the payload is loaded with torch.load(). A patched-image rebuild at version 1.0.3 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must deliver the crafted PyTorch file over the network, for example by hosting it on a model-sharing platform or a package feed the victim fetches from.

• AuthenticationNot required

  No account or credentials are needed to publish or distribute the malicious payload.

• Victim interactionRequired

  A user or automated pipeline must actively load the crafted file with torch.load(), making the attack dependent on social engineering or supply-chain poisoning to trigger execution.

• Attack complexityDetail

  The exploit is reliable and condition-free once the payload is delivered; no race conditions or specific memory layout is required.

Blast Radius

• The attacker achieves arbitrary code execution in the process that calls torch.load(), with the same privileges as the loading application or ML pipeline worker.
• Any model-loading workflow that relies on picklescan as a security gate is silently bypassed, meaning subsequent malicious payloads can also execute without triggering alerts.
• Integrity of the host environment is fully compromised: the attacker can write files, install backdoors, or pivot to other services reachable from that process.