Search for packages
| purl | pkg:pypi/picklescan@0.0.35 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 4.5 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-82fg-2r99-h7v6
|
Duplicate Advisory: PickleScan's pkgutil.resolve_name has a universal blocklist bypass ### Duplicate Advisory This advisory has been withdrawn because it is … |
Vulnerable |
|
PYSEC-2026-225
Aliases: CVE-2026-56304 GHSA-m7j5-r2p5-c39r |
picklescan before 1.0.1 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to create arbitrary zero-byte files via logging.FileHandler class … |
Vulnerable |
|
PYSEC-2026-455
Aliases: CVE-2026-53873 GHSA-7wx9-6375-f5wh |
PickleScan's profile.run blocklist mismatch allows exec() bypass ## Summary picklescan v1.0.3 blocks `profile.Profile.run` and `profile.Profile.runctx` but does NOT block the … |
Vulnerable |
|
PYSEC-2026-456
Aliases: CVE-2026-3490 GHSA-vvpj-8cmc-gx39 |
PickleScan's pkgutil.resolve_name has a universal blocklist bypass ## Summary `pkgutil.resolve_name()` is a Python stdlib function that resolves any `"module:attribute"` string … |
Vulnerable |
|
GHSA-4p4h-9gvq-7xfg
|
Duplicate Advisory: Picklescan Vulnerable to Exfiltration via DNS via linecache and ssl.get_server_certificate # Duplicate Advisory This advisory has been withdrawn … | There are no reported fixed by versions. |
|
PYSEC-2026-2873
Aliases: CVE-2026-53875 GHSA-97f8-7cmv-76j2 |
Picklescan (scan_pytorch) Bypass via dynamic eval MAGIC_NUMBER ### Summary This is a scanning bypass to `scan_pytorch` function in `picklescan`. As … |
Vulnerable |
|
PYSEC-2026-1789
Aliases: CVE-2026-53874 GHSA-9m3x-qqw2-h32h |
picklescan missing detection by simple obfuscation of a `builtins.eval` call ### Summary An unsafe deserialization vulnerability allows any unauthenticated user … |
Vulnerable |
|
PYSEC-2026-4134
Aliases: CVE-2026-56315 GHSA-g38g-8gr9-h9xp |
PickleScan has multiple stdlib modules with direct RCE not in blocklist ## Summary picklescan v1.0.3 (latest) does not block at … |
Vulnerable |
|
GHSA-g7vj-qw6x-g3p8
|
Duplicate Advisory: PickleScan has multiple stdlib modules with direct RCE not in blocklist ### Duplicate Advisory This advisory has been … |
Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-5v23-73v4-w2fp
|
Duplicate Advisory: picklescan has Arbitrary file read using `io.FileIO` ### Duplicate Advisory This advisory has been withdrawn because it is … | |
|
PYSEC-2026-1787
|
picklescan has Arbitrary file read using `io.FileIO` ### Summary Unsafe pickle deserialization allows unauthenticated attackers to read arbitrary server files … |
CVE-2026-53872
GHSA-9726-w42j-3qjr |