CVE-2026-56315 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-56315 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-56315 is a security bypass vulnerability in picklescan, an open-source tool used to detect malicious Python pickle files, which fails to scan and block unsafe globals from at least seven Python standard library modules prior to version 1.0.4.

Technical Detail

The flaw stems from an incomplete allowlist or denylist implementation in picklescan's scanning logic, which does not account for modules including uuid, _osx_support, _aix_support, _pyrepl.pager, and imaplib, among others, leaving at least eight functions capable of providing directory traversal or code execution primitives undetected. An attacker can craft a malicious pickle payload that invokes globals from these overlooked modules, causing the payload to pass picklescan's inspection without triggering any alert. If the scanned artifact is subsequently deserialized in a downstream process, this could result in arbitrary code execution within the context of the deserializing application.

Exploitation Status

No known exploit has been publicly documented or observed as of June 30, 2026. This vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The exploit maturity is currently assessed as none, meaning no proof-of-concept or operational exploit has been confirmed in public or private reporting.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor activity has been associated with CVE-2026-56315 in available intelligence sources.

What To Do

Upgrade picklescan to version 1.0.4 or later immediately, as this release addresses the incomplete module coverage that defines this vulnerability. Organizations using picklescan as a security gate in machine learning pipelines, model registries, or file upload workflows should treat any scans performed with versions prior to 1.0.4 as potentially unreliable and consider rescanning previously approved artifacts. Given the critical CVSS score of 9.8 and the nature of the bypass, patch deployment should be prioritized even in the absence of confirmed exploitation. Teams should also review their defense-in-depth posture around pickle deserialization, as picklescan is a detection control and not a substitute for avoiding unsafe deserialization of untrusted data entirely.