---
id: "GHSA-mq7r-vm99-p7vx"
kind: "vulnerability"
aliases: ["GHSA-mq7r-vm99-p7vx"]
title: "Duplicate Advisory : Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcode"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "withdrawn"
category: "package"
products: [{"name": "picklescan", "fixed": ["0.0.30"], "affected": "< 0.0.30", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["cwe-502", "ml-pipelines", "package", "picklescan", "python", "pytorch"]
not_affected_if: ["no-untrusted-pickles", "not-using-picklescan"]
published_at: "2026-06-26T00:32:05+00:00"
first_seen_at: "2026-11-03T17:41:47+00:00"
updated_at: "2026-11-03T17:42:41+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-mq7r-vm99-p7vx", "first_seen_at": "2026-11-03T17:41:47+00:00"}]
---

# Duplicate Advisory : Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcode

Picklescan, a scanner for Python pickle model files, fails to flag pickles that call idlelib.pyshell.ModifiedInterpreter.runcode from a __reduce__ method. A malicious pickle can therefore pass the scan and run arbitrary commands when pickle.load() opens it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:picklescan affected < 0.0.30 fixed 0.0.30

## How to check

- Check the installed picklescan version with `pip show picklescan`; versions below `0.0.30` are affected.
- Look for picklescan in requirements files, lockfiles or pipelines that scan model files before loading them.

## Fix

- picklescan: upgrade to `0.0.30`
- Note: this advisory is withdrawn as a duplicate of GHSA-3gf5-cxq9-w223; the fix is the same version.

## Timeline

- 2026-11-03T17:41:47+00:00 ghsa https://github.com/advisories/GHSA-mq7r-vm99-p7vx

## From the sources

### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-3gf5-cxq9-w223. This link is maintained to preserve external references.

### Original Description
picklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.ModifiedInterpreter.runcode in __reduce__ methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when the file is loaded via pickle.load(), enabling supply chain attacks on PyTorch models and saved Python objects. This is fixed in version 0.0.30.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_