Search for packages
| purl | pkg:pypi/picklescan@1.0.3 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 4.5 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-82fg-2r99-h7v6
|
Duplicate Advisory: PickleScan's pkgutil.resolve_name has a universal blocklist bypass ### Duplicate Advisory This advisory has been withdrawn because it is … |
Vulnerable |
|
PYSEC-2026-455
Aliases: CVE-2026-53873 GHSA-7wx9-6375-f5wh |
PickleScan's profile.run blocklist mismatch allows exec() bypass ## Summary picklescan v1.0.3 blocks `profile.Profile.run` and `profile.Profile.runctx` but does NOT block the … |
Vulnerable |
|
PYSEC-2026-456
Aliases: CVE-2026-3490 GHSA-vvpj-8cmc-gx39 |
PickleScan's pkgutil.resolve_name has a universal blocklist bypass ## Summary `pkgutil.resolve_name()` is a Python stdlib function that resolves any `"module:attribute"` string … |
Vulnerable |
|
GHSA-4p4h-9gvq-7xfg
|
Duplicate Advisory: Picklescan Vulnerable to Exfiltration via DNS via linecache and ssl.get_server_certificate # Duplicate Advisory This advisory has been withdrawn … | There are no reported fixed by versions. |
|
PYSEC-2026-4134
Aliases: CVE-2026-56315 GHSA-g38g-8gr9-h9xp |
PickleScan has multiple stdlib modules with direct RCE not in blocklist ## Summary picklescan v1.0.3 (latest) does not block at … |
Vulnerable |
|
GHSA-g7vj-qw6x-g3p8
|
Duplicate Advisory: PickleScan has multiple stdlib modules with direct RCE not in blocklist ### Duplicate Advisory This advisory has been … |
Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
PYSEC-2026-2873
|
Picklescan (scan_pytorch) Bypass via dynamic eval MAGIC_NUMBER ### Summary This is a scanning bypass to `scan_pytorch` function in `picklescan`. As … |
CVE-2026-53875
GHSA-97f8-7cmv-76j2 |