Threats tagged 'ghsa-chm9-4rm6-p4gf'

picklescan versions before 0.0.28 fail to detect malicious pickle files that exploit the torch._dynamo.guards.GuardBuilder.get function in reduce methods. This allows attackers to craft pickle files containing embedded code that bypasses picklescan detection and executes arbitrary commands upon loading. The vulnerability is categorized under CWE-502 (Deserialization of Untrusted Data) and is considered high severity.