Search for packages
| purl | pkg:pypi/picklescan@0.0.30 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 4.5 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-rrxm-2pvv-m66x
|
Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.getlincoef ### Summary Picklescan uses the `numpy.f2py.crackfortran.getlincoef` function (a NumPy … |
Vulnerable |
|
GHSA-46h3-79wf-xr6c
|
Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.attrgetter ### Summary Picklescan uses _operator.attrgetter, which is … |
Vulnerable |
|
GHSA-x843-g5mx-g377
|
Picklescan is vulnerable to RCE through missing detection when calling built-in python operator.methodcaller ### Summary Picklescan uses `operator.methodcaller`, which is … |
Vulnerable |
|
GHSA-955r-x9j8-7rhh
|
Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.methodcaller ### Summary Picklescan uses _operator.methodcaller, which is … |
Vulnerable |
|
GHSA-vqmv-47xg-9wpr
|
Picklescan missing detection when calling pty.spawn ### Summary Using pty.spawn, which is a built-in python library function to execute arbitrary … |
Vulnerable |
|
GHSA-cffc-mxrf-mhh4
|
Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.param_eval ### Summary Picklescan uses numpy.f2py.crackfortran.param_eval, which is a function … |
Vulnerable |
|
GHSA-r8g5-cgf2-4m4m
|
Picklescan missing detection when calling numpy.f2py.crackfortran.getlincoef ### Summary An unsafe deserialization vulnerability allows an attacker to execute arbitrary code on … |
Vulnerable |
|
GHSA-4vr7-g93g-cf6m
|
Duplicate Advisory: Picklescan: ZIP archive scan bypass is possible through non-exhaustive Cyclic Redundancy Check ### Duplicate Advisory This advisory has … |
Vulnerable |
|
GHSA-j424-mc44-f4hj
|
Duplicate Advisory: Picklescan Bypass is Possible via File Extension Mismatch ### Duplicate Advisory This advisory has been withdrawn because it … |
Vulnerable |
|
GHSA-hf6h-9wq7-hmjg
|
Duplicate Advisory: Picklescan is Vulnerable to Unsafe Globals Check Bypass through Subclass Imports ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
PYSEC-2025-151
Aliases: CVE-2025-10155 GHSA-jgw4-cr84-mqxg |
An Improper Input Validation vulnerability in the scanning logic of mmaitre314 picklescan versions up to and including 0.0.30 allows a … |
Vulnerable |
|
PYSEC-2025-152
Aliases: CVE-2025-10156 GHSA-mjqp-26hc-grxg |
An Improper Handling of Exceptional Conditions vulnerability in the ZIP archive scanning component of mmaitre314 picklescan allows a remote attacker … |
Vulnerable |
|
PYSEC-2025-153
Aliases: CVE-2025-10157 GHSA-f7qq-56ww-84cr |
A Protection Mechanism Failure vulnerability in mmaitre314 picklescan versions up to and including 0.0.30 allows a remote attacker to bypass … |
Vulnerable |
|
GHSA-5v23-73v4-w2fp
|
Duplicate Advisory: picklescan has Arbitrary file read using `io.FileIO` ### Duplicate Advisory This advisory has been withdrawn because it is … |
Vulnerable |
|
GHSA-82fg-2r99-h7v6
|
Duplicate Advisory: PickleScan's pkgutil.resolve_name has a universal blocklist bypass ### Duplicate Advisory This advisory has been withdrawn because it is … |
Vulnerable |
|
GHSA-7f79-rvx6-vxc4
|
Duplicate Advisory: Picklescan does not block ctypes ### Duplicate Advisory This advisory has been withdrawn because it is a duplicate … |
Vulnerable |
|
GHSA-rmpp-8wf5-xx5q
|
Duplicate Advisory: Picklescan vulnerable to Arbitrary File Writing ### Duplicate Advisory This advisory has been withdrawn because it is a … |
Vulnerable |
|
PYSEC-2026-225
Aliases: CVE-2026-56304 GHSA-m7j5-r2p5-c39r |
picklescan before 1.0.1 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to create arbitrary zero-byte files via logging.FileHandler class … |
Vulnerable |
|
PYSEC-2026-455
Aliases: CVE-2026-53873 GHSA-7wx9-6375-f5wh |
PickleScan's profile.run blocklist mismatch allows exec() bypass ## Summary picklescan v1.0.3 blocks `profile.Profile.run` and `profile.Profile.runctx` but does NOT block the … |
Vulnerable |
|
PYSEC-2026-456
Aliases: CVE-2026-3490 GHSA-vvpj-8cmc-gx39 |
PickleScan's pkgutil.resolve_name has a universal blocklist bypass ## Summary `pkgutil.resolve_name()` is a Python stdlib function that resolves any `"module:attribute"` string … |
Vulnerable |
|
GHSA-4p4h-9gvq-7xfg
|
Duplicate Advisory: Picklescan Vulnerable to Exfiltration via DNS via linecache and ssl.get_server_certificate # Duplicate Advisory This advisory has been withdrawn … | There are no reported fixed by versions. |
|
PYSEC-2026-2873
Aliases: CVE-2026-53875 GHSA-97f8-7cmv-76j2 |
Picklescan (scan_pytorch) Bypass via dynamic eval MAGIC_NUMBER ### Summary This is a scanning bypass to `scan_pytorch` function in `picklescan`. As … |
Vulnerable |
|
PYSEC-2026-1782
Aliases: CVE-2025-71323 GHSA-4675-36f9-wf6r |
Picklescan does not block ctypes ### Summary Picklescan doesnt flag ctypes module as a dangerous module, which is a huge … |
Vulnerable |
|
PYSEC-2026-1785
Aliases: CVE-2025-71320 GHSA-84r2-jw7c-4r5q |
Picklescan has Incomplete List of Disallowed Inputs ### Summary Currently picklescanner only blocks some specific functions of the pydoc and … |
Vulnerable |
|
PYSEC-2026-1783
Aliases: CVE-2025-71339 GHSA-6556-fwc2-fg2p |
Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran._eval_length ### Summary Picklescan uses the `numpy.f2py.crackfortran._eval_length` function (a NumPy … |
Vulnerable |
|
PYSEC-2026-1789
Aliases: CVE-2026-53874 GHSA-9m3x-qqw2-h32h |
picklescan missing detection by simple obfuscation of a `builtins.eval` call ### Summary An unsafe deserialization vulnerability allows any unauthenticated user … |
Vulnerable |
|
PYSEC-2026-1790
Aliases: CVE-2025-71322 GHSA-hgrh-qx5j-jfwx |
Picklescan Bypasses Unsafe Globals Check using pty.spawn ### Summary The vulnerability allows malicious actors to bypass PickleScan's unsafe globals check, … |
Vulnerable |
|
PYSEC-2026-1791
Aliases: CVE-2025-71321 GHSA-m273-6v24-x4m4 |
Picklescan vulnerable to Arbitrary File Writing ### Summary Picklescan has got open() and shutil in its default dangerous blocklist to … |
Vulnerable |
|
PYSEC-2026-1787
Aliases: CVE-2026-53872 GHSA-9726-w42j-3qjr |
picklescan has Arbitrary file read using `io.FileIO` ### Summary Unsafe pickle deserialization allows unauthenticated attackers to read arbitrary server files … |
Vulnerable |
|
PYSEC-2026-4131
Aliases: CVE-2025-71365 GHSA-3329-ghmp-jmv5 |
Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran.myeval ### Summary Picklescan uses numpy.f2py.crackfortran.myeval, which is a function … |
Vulnerable |
|
PYSEC-2026-4134
Aliases: CVE-2026-56315 GHSA-g38g-8gr9-h9xp |
PickleScan has multiple stdlib modules with direct RCE not in blocklist ## Summary picklescan v1.0.3 (latest) does not block at … |
Vulnerable |
|
GHSA-g7vj-qw6x-g3p8
|
Duplicate Advisory: PickleScan has multiple stdlib modules with direct RCE not in blocklist ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-x36p-c636-788x
|
Duplicate Advisory: Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran.myeval ### Duplicate Advisory This advisory has been … |
Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-49gj-c84q-6qm9
|
Picklescan is missing detection when calling built-in python cProfile.run ### Summary Using cProfile.run function, which is a built-in python library … | |
|
GHSA-p9w7-82w4-7q8m
|
Picklescan is missing detection when calling built-in python lib2to3.pgen2.pgen.ParserGenerator.make_label ### Summary Using lib2to3.pgen2.pgen.ParserGenerator.make_label function, which is a built-in python library … | |
|
GHSA-m869-42cg-3xwr
|
Picklescan is missing detection when calling built-in python idlelib.run.Executive.runcode ### Summary Using idlelib.run.Executive.runcode function, which is a built-in python library … | |
|
GHSA-fqq6-7vqf-w3fg
|
Picklescan is missing detection when calling built-in python doctest.debug_script ### Summary Using doctest.debug_script function, which is a built-in python library … | |
|
GHSA-3gf5-cxq9-w223
|
Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcode ### Summary Using idlelib.pyshell.ModifiedInterpreter.runcode function, which is a built-in python library … | |
|
GHSA-4whj-rm5r-c2v8
|
Picklescan is missing detection when calling pytorch function torch.utils.bottleneck.__main__.run_autograd_prof ### Summary Using torch.utils.bottleneck.\_\_main\_\_.run_autograd_prof function, which is a pytorch library function … | |
|
GHSA-q77w-mwjj-7mqx
|
Picklescan is missing detection when calling built-in python library asyncio.unix_events._UnixSubprocessTransport._start ### Summary Using asyncio.unix_events._UnixSubprocessTransport._start function, which is a built-in python … | |
|
PYSEC-2026-246
|
picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods. Attackers can embed undetected code in … |
CVE-2025-71357
GHSA-j343-8v2j-ff7w |
|
PYSEC-2026-247
|
picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute arbitrary code. … |
CVE-2025-71378
GHSA-9w88-8rmg-7g2p |
|
PYSEC-2026-1792
|
Picklescan is missing detection when calling built-in python ensurepip._run_pip ### Summary Using ensurepip._run_pip function, which is a built-in python library … |
CVE-2025-71344
GHSA-xp4f-hrf8-rxw7 |
|
GHSA-fcqg-3mwf-cfcf
|
Duplicate Advisory: Picklescan is missing detection when calling built-in Python cProfile.runctx ### Duplicate Advisory This advisory has been withdrawn because … | |
|
GHSA-8mc5-7w9m-fqv6
|
Duplicate Advisory: Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcommand ### Duplicate Advisory This advisory has been withdrawn because … |