CVE-2026-53875
2026-06-17
17h17 +00:00
17h17 +00:00
指定 CVE 通知
随时了解指定 CVE 的变更。
CVE 描述
picklescan before 1.0.3 contains a scanning bypass vulnerability in the scan_pytorch function that allows attackers to embed malicious magic numbers via dynamic eval using the __reduce__ trick. Attackers can craft malicious PyTorch payloads that evade picklescan detection while remaining executable, enabling arbitrary code execution when loaded with torch.load().
CVE 信息
相关弱点
| 弱点名称 | 来源 | |
|---|---|---|
| Improper Neutralization of Directives in Dynamically Evaluated Code The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval"). |
