HIGHCVSS 7.6

GHSA-fcqg-3mwf-cfcf

Duplicate Advisory: Picklescan is missing detection when calling built-in Python cProfile.runctx

Published: 2026-06-21
Modified: 2026-09-11
Sources: github-advisory

Summary

### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9w88-8rmg-7g2p. This link is maintained to preserve external references. ### Original Description picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute arbitrary code. Malicious pickle files bypass picklescan detection and execute remote code when loaded via pickle.load().

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
PyPI	picklescan	—	0.0.30

Remediation: Upgrade to 0.0.30 or later.

References

https://github.com/advisories/GHSA-fcqg-3mwf-cfcf

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.