Description
picklescan before 0.0.29 fails to detect malicious idlelib.calltip.Calltip.fetch_tip calls in pickle files, allowing remote code execution. Attackers can embed undetected payloads in pickle files that execute arbitrary code when loaded via pickle.load().
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| picklescan | picklescan | < 0.0.29 | 0.0.29 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | picklescan | < 0.0.29 | 0.0.29 | GHSA-8r4j-24qv-fmq9 |
References
- GitHub Security Advisory (GHSA-8r4j-24qv-fmq9) vendor-advisory
- VulnCheck Advisory: picklescan - Remote Code Execution via Undetected idlelib.calltip.Calltip.fetch_tip third-party-advisory