A critical remote code execution vulnerability in Picklescan allows unauthenticated attackers to execute arbitrary code via specially crafted pickle files.

This is an improper input validation vulnerability where the scanner fails to recognize the trace.Trace.run function. By crafting a malicious pickle file that leverages this built-in function, an unauthenticated attacker can bypass detection mechanisms and achieve arbitrary code execution upon deserialization.

The CVSS score of 8.1 reflects a high severity risk that could lead to complete system compromise. Successful exploitation allows an attacker to execute arbitrary code with the privileges of the application, potentially resulting in data exfiltration, lateral movement within the network, and full loss of system integrity.

Immediate Action: Upgrade to Picklescan version 0.0.29 or later immediately to patch the detection bypass.

Proactive Monitoring: Monitor system logs for anomalous deserialization patterns or unexpected process execution following file processing tasks.

Compensating Controls: Implement strict file validation and sandboxing for any untrusted pickle files being processed, and limit the permissions of the service account running the scanner.

Public Exploit Available: true

This vulnerability presents a clear and present danger to environments processing untrusted pickle data. Organizations should prioritize the update to version 0.0.29 as the primary mitigation strategy to prevent unauthorized code execution.