GHSA-q8qp-8jq6-78mc

Duplicate Advisory: Picklescan missing detection when calling pytorch function torch.jit.unsupported_tensor_ops.execWrapper

Published

2026-06-23

Modified

2026-09-23

Sources

github-advisory

Summary

### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vr7h-p6mm-wpmh. This link is maintained to preserve external references. ### Original Description picklescan before 0.0.28 fails to detect malicious torch.jit.unsupported_tensor_ops.execWrapper function calls embedded in pickle files. Attackers can craft malicious pickle files that bypass picklescan detection and execute arbitrary code when loaded via pickle.load().

Affected packages

Remediation: Upgrade to 0.0.28 or later.

References

• https://github.com/advisories/GHSA-q8qp-8jq6-78mc