PT-2026-55667

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 0.0.30 Description The software fails to detect malicious pickle files that exploit the make label function within lib2to3.pgen2.pgen.ParserGenerator inside the reduce method. This allows attackers to craft pickle...

Linux Distros Unpatched Vulnerability : CVE-2014-3539

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - base/oi/doa.py in the Rope library in CPython aka Python allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load...

Picklescan missing detection when calling pytorch function torch._dynamo.guards.GuardBuilder.get

Summary Using torch.dynamo.guards.GuardBuilder.get function, which is a pytorch library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to torch.dynamo.guards.GuardBuilder.get function in reduce...

CVE-2024-3568 Arbitrary Code Execution via Deserialization in huggingface/transformers

The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data within the loadrepocheckpoint function of the TFPreTrainedModel class. Attackers can execute arbitrary code and commands by crafting a malicious serialized payload, exploiting...

lagom 安全漏洞

lagom is a PyTorch infrastructure for rapid prototyping of reinforcement learning algorithms from the Xingdong Zuo personal developer. A security vulnerability exists in lagom version v.0.1.2, which stems from a vulnerability that allows a local attacker to execute arbitrary code via the picklelo...

PT-2024-20900 · Unknown · Zuoxingdong Lagom

Name of the Vulnerable Software and Affected Versions: zuoxingdong lagom version 0.1.2 Description: The issue allows a local attacker to execute arbitrary code via the pickle load function of the serialize.py file. Recommendations: For zuoxingdong lagom version 0.1.2, consider disabling the pickl...

SUSE CVE-2014-3539

base/oi/doa.py in the Rope library in CPython aka Python allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load...

The vulnerability of the pickle.load() function in Manuscript software, related to the restoration of unreliable data in memory, allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the pickle.load function in software for manuscript writers involves restoring unreliable data in memory. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data, compromise its integrity, and even cause service failures...

PT-2021-4272 · Unknown +1 · Manuskript +1

Name of the Vulnerable Software and Affected Versions: Manuskript versions 0.12.0 and earlier Description: The issue is related to insecure deserialization via the pickle.load function in settings.py, allowing remote attackers to execute arbitrary code by crafting a settings.pickle file in a...

pycparser command execution vulnerability

pycparser is a C parser written in Python. A command execution vulnerability exists in pycparser's pickle.load call to import data within the 'readpickle' function of the LRTable class in the yacc.py file. A remote attacker can exploit this vulnerability to execute arbitrary python commands with...

PYSEC-2018-64

In conference-scheduler-cli, a pickle.load call on imported data allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call...

GHSA-R38R-QP28-2M63 Code injection in rope

base/oi/doa.py in the Rope library in CPython aka Python allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load...

PYSEC-2018-100

base/oi/doa.py in the Rope library in CPython aka Python allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load...

PYSEC-2018-100

base/oi/doa.py in the Rope library in CPython aka Python allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load...

DEBIAN-CVE-2014-3539

base/oi/doa.py in the Rope library in CPython aka Python allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load...

UBUNTU-CVE-2014-3539

base/oi/doa.py in the Rope library in CPython aka Python allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load...

PT-2018-4213 · Python · Rope +1

Name of the Vulnerable Software and Affected Versions: CPython affected versions not specified Description: The issue allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load in the Rope library. This is due to a problem in the base/oi/doa.py file...