PT-2026-51762

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 0.0.29 Description An issue exists where the software fails to detect malicious pickle files that utilize the SetText function within idlelib.debugobj.ObjectTreeItem inside reduce methods. Attackers can craft pickl...

PT-2026-55673

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 0.0.29 Description The software fails to detect malicious pickle files that utilize the idlelib.calltip.get entity function within reduce methods. This allows attackers to embed undetected code in pickle files, whi...

PT-2026-51385

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 0.0.29 Description An issue exists where the software fails to detect malicious pickle files that utilize the get entity function within the idlelib.autocomplete.AutoComplete module in reduce methods. This allows...

PT-2026-51763

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 0.0.29 Description An issue exists where the software fails to detect malicious calls to the fetch tip function within the idlelib.calltip.Calltip module in pickle files. This occurs because the fetch tip function,...

PT-2026-51384

Name of the Vulnerable Software and Affected Versions picklescan versions 0.0.26 and earlier Description The software fails to detect the ensurepip. run pip built-in function when scanning pickle files. Attackers can craft malicious pickle files by embedding calls to ensurepip. run pip within...

PT-2026-51216

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 0.0.30 Description The software fails to detect malicious pickle files that utilize the idlelib.pyshell.ModifiedInterpreter.runcommand function within reduce methods. This allows attackers to embed undetected code ...

PT-2026-55675

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 0.0.30 Description The software fails to detect the asyncio.unix events. UnixSubprocessTransport. start function within pickle reduce methods. This allows remote code execution as attackers can create malicious...

PT-2026-55667

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 0.0.30 Description The software fails to detect malicious pickle files that exploit the make label function within lib2to3.pgen2.pgen.ParserGenerator inside the reduce method. This allows attackers to craft pickle...

Linux Distros Unpatched Vulnerability : CVE-2014-3539

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - base/oi/doa.py in the Rope library in CPython aka Python allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load...

Linux Distros Unpatched Vulnerability : CVE-2018-7889

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code via a craft...

Remote Code Execution (RCE)

Overview picklescan is a Security scanner detecting Python Pickle files performing suspicious actions Affected versions of this package are vulnerable to Remote Code Execution RCE due to using torch.utils.configmodule.loadconfig function. An attacker can execute arbitrary code by crafting a...

Picklescan is missing detection when calling pytorch function torch.utils._config_module.load_config

Summary Using torch.utils.configmodule.loadconfig function, which is a pytorch library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker crafts the payload by calling the torch.utils.configmodule.loadconfig function via the...

GHSA-VV6J-3G6G-2PVJ Picklescan is missing detection when calling pytorch function torch.utils._config_module.load_config

Summary Using torch.utils.configmodule.loadconfig function, which is a pytorch library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker crafts the payload by calling the torch.utils.configmodule.loadconfig function via the...

Picklescan missing detection when calling pytorch function torch.jit.unsupported_tensor_ops.execWrapper

Summary Using torch.jit.unsupportedtensorops.execWrapper function, which is a pytorch library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to torch.jit.unsupportedtensorops.execWrapper function...

GHSA-VR7H-P6MM-WPMH Picklescan missing detection when calling pytorch function torch.jit.unsupported_tensor_ops.execWrapper

Summary Using torch.jit.unsupportedtensorops.execWrapper function, which is a pytorch library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to torch.jit.unsupportedtensorops.execWrapper function...

Picklescan missing detection when calling pytorch function torch.utils.data.datapipes.utils.decoder.basichandlers

Summary Using torch.utils.data.datapipes.utils.decoder.basichandlers function, which is a pytorch library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to...

GHSA-H3QP-7FH3-F8H4 Picklescan missing detection when calling pytorch function torch.utils.data.datapipes.utils.decoder.basichandlers

Summary Using torch.utils.data.datapipes.utils.decoder.basichandlers function, which is a pytorch library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to...

Remote Code Execution (RCE)

Overview picklescan is a Security scanner detecting Python Pickle files performing suspicious actions Affected versions of this package are vulnerable to Remote Code Execution RCE due to using torch.utils.data.datapipes.utils.decoder.basichandlers function. An attacker can execute arbitrary code ...

Picklescan missing detection when calling pytorch function torch.utils.collect_env.run

Summary Using torch.utils.collectenv.run function, which is a pytorch library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to torch.utils.collectenv.run function in reduce method Then when the...

GHSA-F745-W6JP-HPXX Picklescan missing detection when calling pytorch function torch.utils.collect_env.run

Summary Using torch.utils.collectenv.run function, which is a pytorch library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to torch.utils.collectenv.run function in reduce method Then when the...