GHSA-gq8p-2329-gh3x

Duplicate Advisory: Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.fetch_completions

Published

2026-06-23

Modified

2026-09-23

Sources

github-advisory

Summary

### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7cq8-mj8x-j263. This link is maintained to preserve external references. ### Original Description picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.autocomplete.AutoComplete.fetch_completions in reduce methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when loaded by victims.

Affected packages

Remediation: Upgrade to 0.0.29 or later.

References

• https://github.com/advisories/GHSA-gq8p-2329-gh3x