CVE-2026-53874
picklescan before 1.0.1 contains an unsafe deserialization vulnerability allowing unauthenticated users to execute arbitrary code by hiding eval calls nested under callable objects via getattr. Attackers can embed malicious code in pickle files that evades detection but executes when the pickle is loaded from untrusted sources.
- Affected products
- Picklescan
- Fix
- Available
- CVSS 3.1
- 9.8 CRITICAL
- EPSS
- 0.5% (41th percentile)
- Weakness
- CWE-502
- NVD status
- Deferred
- Published
- 2026-06-17
CVE-2026-53874 at NVD
No indexed exploits for CVE-2026-53874 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-53874 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.