{"id":"GHSA-mq7r-vm99-p7vx","kind":"vulnerability","aliases":["GHSA-mq7r-vm99-p7vx"],"related":[],"title":"Duplicate Advisory : Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcode","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-3gf5-cxq9-w223. This link is maintained to preserve external references.\n\n### Original Description\npicklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.ModifiedInterpreter.runcode in __reduce__ methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when the file is loaded via pickle.load(), enabling supply chain attacks on PyTorch models and saved Python objects. This is fixed in version 0.0.30.","summary":"Picklescan, a scanner for Python pickle model files, fails to flag pickles that call idlelib.pyshell.ModifiedInterpreter.runcode from a __reduce__ method. A malicious pickle can therefore pass the scan and run arbitrary commands when pickle.load() opens it.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"picklescan","fixed":["0.0.30"],"affected":"< 0.0.30","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["cwe-502","ml-pipelines","package","picklescan","python","pytorch"],"not_affected_if":["no-untrusted-pickles","not-using-picklescan"],"how_to_check":"- Check the installed picklescan version with `pip show picklescan`; versions below `0.0.30` are affected.\n- Look for picklescan in requirements files, lockfiles or pipelines that scan model files before loading them.","fix":"- picklescan: upgrade to `0.0.30`\n- Note: this advisory is withdrawn as a duplicate of GHSA-3gf5-cxq9-w223; the fix is the same version.","status":"withdrawn","published_at":"2026-06-26T00:32:05+00:00","first_seen_at":"2026-11-03T17:41:47+00:00","triaged_at":"2026-11-03T17:42:41+00:00","updated_at":"2026-11-03T17:42:41+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T17:42:41Z","model":"claude-haiku-5-5","output":{"fix":"- picklescan: upgrade to `0.0.30`\n- Note: this advisory is withdrawn as a duplicate of GHSA-3gf5-cxq9-w223; the fix is the same version.","reach":"unknown","title":"Picklescan: misses malicious pickle files that run arbitrary commands on load","impact":"high","summary":"Picklescan, a scanner for Python pickle model files, fails to flag pickles that call idlelib.pyshell.ModifiedInterpreter.runcode from a __reduce__ method. A malicious pickle can therefore pass the scan and run arbitrary commands when pickle.load() opens it.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","picklescan","pytorch","ml-pipelines"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Arbitrary commands run when a malicious pickle file is loaded","analyst_note":"Withdrawn duplicate; confirm the live advisory GHSA-3gf5-cxq9-w223 carries the same details and fix range.","how_to_check":"- Check the installed picklescan version with `pip show picklescan`; versions below `0.0.30` are affected.\n- Look for picklescan in requirements files, lockfiles or pipelines that scan model files before loading them.","plain_action":"","needs_analyst":true,"not_affected_if":["no-untrusted-pickles","not-using-picklescan"],"who_is_affected":"Teams that use picklescan to screen pickle or PyTorch model files before loading them are exposed, because the scanner gives a false pass. Teams that do not run picklescan, or that never load untrusted pickle files, can skip it. The advisory is withdrawn as a duplicate, so the live record is GHSA-3gf5-cxq9-w223.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000764,"input_tokens":4302,"output_tokens":668,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-502':26B '0.0.26':98C '0.0.30':146C '3gf5':83C 'advisori':2A,69C,71C 'arbitrari':63B,121C 'attack':111C,133C 'built':10A 'built-in':9A 'call':8A,47B 'chain':132C 'code':115C 'command':64B,122C 'cwe':25B 'cxq9':84C 'descript':95C 'detect':6A,101C 'duplic':1A,68C,79C 'emb':113C 'enabl':130C 'execut':120C 'extern':92C 'fail':42B,99C 'file':41B,104C,118C,125C 'fix':143C 'flag':44B 'ghsa':15A,20A,82C 'ghsa-3gf5-cxq9-w223':81C 'ghsa-mq7r-vm99-p7vx':14A,19A 'idlelib.pyshell.modifiedinterpreter.runcode':13A,48B,107C 'invok':106C 'link':87C 'load':127C 'maintain':89C 'malici':54B,102C 'method':52B,110C 'miss':5A 'ml':28B 'ml-pipelin':27B 'model':40B,136C 'mq7r':16A,21A 'object':140C 'open':67B 'origin':94C 'p7vx':18A,23A 'packag':30B 'pass':58B 'pickl':39B,45B,55B,103C,117C 'pickle.load':66B,129C 'picklescan':3A,24A,31B,34B,96C 'pipelin':29B 'preserv':91C 'python':12A,32B,38B,139C 'pytorch':33B,135C 'reduc':51B,109C 'refer':93C 'run':62B 'save':138C 'scan':60B 'scanner':36B 'suppli':131C 'therefor':57B 'undetect':114C 'version':145C 'via':128C 'vm99':17A,22A 'w223':85C 'withdrawn':74C","nicknames":[],"mitigations":[],"who_affected":"Teams that use picklescan to screen pickle or PyTorch model files before loading them are exposed, because the scanner gives a false pass. Teams that do not run picklescan, or that never load untrusted pickle files, can skip it. The advisory is withdrawn as a duplicate, so the live record is GHSA-3gf5-cxq9-w223.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["picklescan"],"ptokens":["picklescan"],"labels":["cwe502","high","mlpipelines","package","picklescan","pypi","python","pytorch"],"campaign_type":null,"first_public_at":"2026-06-26T00:32:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-mq7r-vm99-p7vx","url":"https://github.com/advisories/GHSA-mq7r-vm99-p7vx","severity":"high","published_at":"2026-06-26T00:32:05+00:00","modified_at":"2026-11-03T17:37:07+00:00","first_seen_at":"2026-11-03T17:41:47+00:00","fetched_at":"2026-11-03T17:41:47+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}