HIGHCVSS 7.6

GHSA-8mc5-7w9m-fqv6

Duplicate Advisory: Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcommand

Published: 2026-06-21
Modified: 2026-09-11
Sources: github-advisory

Summary

### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-j343-8v2j-ff7w. This link is maintained to preserve external references. ### Original Description picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
PyPI	picklescan	—	0.0.30

Remediation: Upgrade to 0.0.30 or later.

References

https://github.com/advisories/GHSA-8mc5-7w9m-fqv6

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.