Description
Py2Play allows remote attackers to execute arbitrary Python code via pickled objects, which Py2Play unpickles and executes.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | py2play | 0.1.7-1sarge1 | DSA-856-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | py2play | <= 0.1.8 | — | GHSA-wcpc-f63g-x26q |
Advisories 1
- DSA-856-1 py2play - design error Debian Security (DSA / DLA) · Mar 9, 2026
References
- 16855 third-party-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=326976
- DSA-856 vendor-advisory
- 14864 vdb-entry
- 17106 third-party-advisory
- http://soya.literati.org/
- GLSA-200509-09 vendor-advisory
- https://bugs.gentoo.org/show_bug.cgi?id=103524