picklescan versions before 0.0.29 fail to detect malicious pickle files that exploit the idlelib.calltip.get_entity function in reduce methods. This allows attackers to embed code in pickle files that executes remote commands when loaded by victims. The vulnerability is classified under CWE-502 (Deserialization of Untrusted Data) and is considered high severity. No patch or official fix is currently documented. No known exploits in the wild have been reported.
picklescan versions before 0.0.33 do not detect operator.methodcaller function calls in pickle files, enabling attackers to bypass security checks. This allows remote attackers to craft malicious pickle payloads that execute arbitrary code when loaded, potentially compromising systems relying on picklescan for validation.
picklescan versions before 0.0.30 fail to detect the asyncio.unix_events._UnixSubprocessTransport._start function when used in pickle reduce methods. This allows attackers to craft malicious pickle files that evade detection but execute arbitrary commands upon loading, leading to remote code execution.
picklescan versions before 0.0.28 fail to detect malicious pickle files that exploit the torch._dynamo.guards.GuardBuilder.get function in reduce methods. This allows attackers to craft pickle files containing embedded code that bypasses picklescan detection and executes arbitrary commands upon loading. The vulnerability is categorized under CWE-502 (Deserialization of Untrusted Data) and is considered high severity.
Picklescan versions before 0.0.33 fail to detect a specific malicious gadget in pickle __reduce__ methods, enabling attackers to execute arbitrary Python code by crafting malicious pickle files. This bypasses Picklescan's safety checks and can lead to supply-chain poisoning of shared model files.
picklescan versions before 0.0.28 fail to detect malicious function calls to torch.utils.bottleneck.__main__.run_cprofile embedded in pickle files. This allows attackers to bypass safety checks and embed undetected code that can lead to arbitrary code execution when victims load these pickle files.
picklescan versions before 0.0.34 do not detect _operator.attrgetter function calls in pickle payloads. This allows attackers to craft malicious pickle files that use _operator.attrgetter in reduce methods to bypass security checks and execute arbitrary code during pickle.load().
picklescan versions before 0.0.30 fail to detect malicious pickle files that invoke the torch.utils.bottleneck.__main__.run_autograd_prof function. This allows attackers to embed code in pickle files that executes during deserialization, enabling remote code execution.
picklescan versions before 0.0.34 do not detect the _operator.methodcaller built-in function when scanning pickle files for malicious code. This allows attackers to craft malicious pickle payloads that evade detection and execute arbitrary code upon loading with pickle.load().
Picklescan versions before 0.0.28 fail to detect malicious pickle files that exploit torch.utils.data.datapipes.utils.decoder.basichandlers in reduce methods. This allows attackers to bypass safety checks and embed malicious code that executes during deserialization, enabling remote code execution.
picklescan versions before 0.0.30 fail to detect malicious pickle files that exploit the lib2to3.pgen2.pgen.ParserGenerator.make_label function used in the reduce method. This allows attackers to craft pickle files that evade detection but execute arbitrary commands when loaded with pickle.load(). The vulnerability is categorized under CWE-502 (Deserialization of Untrusted Data). No patch or official fix information is provided. No known exploits in the wild have been reported.
picklescan versions before 0.0.30 fail to detect malicious pickle files that exploit idlelib.run.Executive.runcode in reduce methods. This allows attackers to embed code in pickle files that executes during pickle.load, potentially enabling remote code execution in PyTorch models and supply chain attacks. No patch information is currently available.
picklescan versions before 0.0.33 fail to detect malicious pickle files that exploit the numpy.f2py.crackfortran.param_eval function in reduce methods. This allows attackers to bypass security checks and embed code that executes during deserialization, leading to arbitrary code execution in applications that load untrusted pickle data.
picklescan versions before 0.0.33 do not detect unsafe deserialization vulnerabilities related to numpy.f2py.crackfortran functions that call eval on arbitrary strings. This allows attackers to embed malicious code in pickle files, which executes when loaded from untrusted sources, leading to potential code execution.
picklescan versions before 0.0.29 fail to detect malicious pickle payloads that exploit lib2to3.pgen2.grammar.Grammar.loads in the reduce method. This allows attackers to craft pickle files that evade detection and execute arbitrary code during deserialization with pickle.load(). The vulnerability is categorized as CWE-502 (Deserialization of Untrusted Data) and has a high severity rating.
picklescan versions through 0.0.26 fail to detect malicious pickle files that invoke idlelib.pyshell.ModifiedInterpreter.runcode in __reduce__ methods. This allows attackers to embed undetected code in pickle files that execute arbitrary commands when loaded via pickle.load(), enabling supply chain attacks on PyTorch models and saved Python objects. The issue is fixed in version 0.0.30.
PickleScan versions before 1.0.4 do not block certain Python standard library modules that allow direct arbitrary command execution. This flaw enables attackers to craft malicious pickle files that import these unblocked modules, bypassing PickleScan's safety validation and leading to remote code execution. The advisory has been withdrawn as a duplicate of GHSA-g38g-8gr9-h9xp but remains for reference.
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-9w88-8rmg-7g2p. This link is maintained to preserve external references.
### Original Description
picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute arbitrary code. Malicious pickle files bypass picklescan detection and execute remote code when loaded via pickle.load().
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-j343-8v2j-ff7w. This link is maintained to preserve external references.
### Original Description
picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-v7x6-rv5q-mhwc. This link is maintained to preserve external references.
### Original Description
picklescan before 0.0.25 fails to detect malicious pickle files that use timeit.timeit() in the __reduce__ method, allowing remote code execution. Attackers can craft pickle files that import dangerous libraries like os and execute arbitrary system commands, which evade picklescan detection and execute when pickle.load() is called.