Description
In conference-scheduler-cli, a pickle.load call on imported data allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | conference-scheduler-cli | <= 0.10.1 | — | GHSA-cf3c-fffp-34qh |
| PyPI | conference-scheduler-cli | all versions | — | PYSEC-2018-64 |