Threats tagged 'ghsa-8f67-79jr-8vpr'

picklescan versions before 0.0.30 fail to detect malicious pickle files that exploit the lib2to3.pgen2.pgen.ParserGenerator.make_label function used in the reduce method. This allows attackers to craft pickle files that evade detection but execute arbitrary commands when loaded with pickle.load(). The vulnerability is categorized under CWE-502 (Deserialization of Untrusted Data). No patch or official fix information is provided. No known exploits in the wild have been reported.