Live › vulnerability › GHSA-mq7r-vm99-p7vx
Picklescan, a scanner for Python pickle model files, fails to flag pickles that call idlelib.pyshell.ModifiedInterpreter.runcode from a __reduce__ method. A malicious pickle can therefore pass the scan and run arbitrary commands when pickle.load() opens it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 17:41 UTC. All times on this page are UTC.
Teams that use picklescan to screen pickle or PyTorch model files before loading them are exposed, because the scanner gives a false pass. Teams that do not run picklescan, or that never load untrusted pickle files, can skip it. The advisory is withdrawn as a duplicate, so the live record is GHSA-3gf5-cxq9-w223.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| picklescan | pypi | < 0.0.30 | 0.0.30 |
pip show picklescan; versions below 0.0.30 are affected.0.0.30Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
This advisory has been withdrawn because it is a duplicate of GHSA-3gf5-cxq9-w223. This link is maintained to preserve external references.
picklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.ModifiedInterpreter.runcode in reduce methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when the file is loaded via pickle.load(), enabling supply chain attacks on PyTorch models and saved Python objects. This is fixed in version 0.0.30.
This page as .md · .json · in your agent: get_signal("GHSA-mq7r-vm99-p7vx")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.