picklescan versions before 0.0.29 fail to detect malicious pickle files that exploit the idlelib.calltip.get_entity function in reduce methods. This allows attackers to embed code in pickle files that executes remote commands when loaded by victims. The vulnerability is classified under CWE-502 (Deserialization of Untrusted Data) and is considered high severity. No patch or official fix is currently documented. No known exploits in the wild have been reported.
picklescan versions before 0.0.33 do not detect operator.methodcaller function calls in pickle files, enabling attackers to bypass security checks. This allows remote attackers to craft malicious pickle payloads that execute arbitrary code when loaded, potentially compromising systems relying on picklescan for validation.
picklescan versions before 0.0.28 fail to detect malicious pickle files that exploit the torch._dynamo.guards.GuardBuilder.get function in reduce methods. This allows attackers to craft pickle files containing embedded code that bypasses picklescan detection and executes arbitrary commands upon loading. The vulnerability is categorized under CWE-502 (Deserialization of Untrusted Data) and is considered high severity.
Picklescan versions before 0.0.33 fail to detect a specific malicious gadget in pickle __reduce__ methods, enabling attackers to execute arbitrary Python code by crafting malicious pickle files. This bypasses Picklescan's safety checks and can lead to supply-chain poisoning of shared model files.
picklescan versions before 0.0.28 fail to detect malicious function calls to torch.utils.bottleneck.__main__.run_cprofile embedded in pickle files. This allows attackers to bypass safety checks and embed undetected code that can lead to arbitrary code execution when victims load these pickle files.
picklescan versions before 0.0.34 do not detect _operator.attrgetter function calls in pickle payloads. This allows attackers to craft malicious pickle files that use _operator.attrgetter in reduce methods to bypass security checks and execute arbitrary code during pickle.load().
picklescan versions before 0.0.30 fail to detect malicious pickle files that invoke the torch.utils.bottleneck.__main__.run_autograd_prof function. This allows attackers to embed code in pickle files that executes during deserialization, enabling remote code execution.
picklescan versions before 0.0.34 do not detect the _operator.methodcaller built-in function when scanning pickle files for malicious code. This allows attackers to craft malicious pickle payloads that evade detection and execute arbitrary code upon loading with pickle.load().
Picklescan versions before 0.0.28 fail to detect malicious pickle files that exploit torch.utils.data.datapipes.utils.decoder.basichandlers in reduce methods. This allows attackers to bypass safety checks and embed malicious code that executes during deserialization, enabling remote code execution.
picklescan versions before 0.0.30 fail to detect malicious pickle files that exploit the lib2to3.pgen2.pgen.ParserGenerator.make_label function used in the reduce method. This allows attackers to craft pickle files that evade detection but execute arbitrary commands when loaded with pickle.load(). The vulnerability is categorized under CWE-502 (Deserialization of Untrusted Data). No patch or official fix information is provided. No known exploits in the wild have been reported.
picklescan versions before 0.0.30 fail to detect malicious pickle files that exploit idlelib.run.Executive.runcode in reduce methods. This allows attackers to embed code in pickle files that executes during pickle.load, potentially enabling remote code execution in PyTorch models and supply chain attacks. No patch information is currently available.
picklescan versions before 0.0.29 fail to detect malicious pickle payloads that exploit lib2to3.pgen2.grammar.Grammar.loads in the reduce method. This allows attackers to craft pickle files that evade detection and execute arbitrary code during deserialization with pickle.load(). The vulnerability is categorized as CWE-502 (Deserialization of Untrusted Data) and has a high severity rating.
PickleScan versions before 1.0.4 do not block certain Python standard library modules that allow direct arbitrary command execution. This flaw enables attackers to craft malicious pickle files that import these unblocked modules, bypassing PickleScan's safety validation and leading to remote code execution. The advisory has been withdrawn as a duplicate of GHSA-g38g-8gr9-h9xp but remains for reference.
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-9w88-8rmg-7g2p. This link is maintained to preserve external references.
### Original Description
picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute arbitrary code. Malicious pickle files bypass picklescan detection and execute remote code when loaded via pickle.load().
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-j343-8v2j-ff7w. This link is maintained to preserve external references.
### Original Description
picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-v7x6-rv5q-mhwc. This link is maintained to preserve external references.
### Original Description
picklescan before 0.0.25 fails to detect malicious pickle files that use timeit.timeit() in the __reduce__ method, allowing remote code execution. Attackers can craft pickle files that import dangerous libraries like os and execute arbitrary system commands, which evade picklescan detection and execute when pickle.load() is called.
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-vv6j-3g6g-2pvj. This link is maintained to preserve external references.
### Original Description
picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methods. Attackers can craft pickle files embedding arbitrary code that evades detection but executes during pickle.load, enabling remote code execution in supply chain attacks.
CVE-2025-71378 is a high-severity vulnerability in picklescan versions before 0.0.30. The tool fails to detect cProfile.runctx function calls within pickle file reduce methods, allowing malicious pickle files to bypass detection. When such files are loaded using pickle.load(), they can execute arbitrary remote code.
CVE-2025-71357 is a deserialization vulnerability in picklescan versions before 0.0.30. The tool fails to detect malicious pickle files that use idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods. This allows attackers to embed code in pickle files that executes remote commands when loaded.
CVE-2025-71351 is a vulnerability in picklescan versions before 0.0.25 where the tool fails to detect malicious pickle files that exploit the timeit.timeit() function in the __reduce__ method. This allows attackers to craft pickle files that import dangerous libraries such as os and execute arbitrary system commands when unpickled, bypassing picklescan detection.