Home

Description

picklescan before 0.0.33 contains an incomplete deny-list that fails to block pydoc.locate and operator.methodcaller functions, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle files using these unblocked functions to achieve arbitrary code execution when the pickle is deserialized.

PUBLISHED Reserved 2026-06-08 | Published 2026-06-17 | Updated 2026-06-17 | Assigner VulnCheck




CRITICAL: 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CRITICAL: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

Incomplete List of Disallowed Inputs

Product status

Default status
unaffected

Any version before 0.0.33
affected

0.0.33 (semver)
unaffected

Credits

0x-Apollyon reporter

References

github.com/...lescan/security/advisories/GHSA-84r2-jw7c-4r5q exploit

github.com/...lescan/security/advisories/GHSA-84r2-jw7c-4r5q (GHSA Advisory GHSA-84r2-jw7c-4r5q) vendor-advisory

www.vulncheck.com/...cution-via-incomplete-disallowed-inputs (VulnCheck Advisory: picklescan - Remote Code Execution via Incomplete Disallowed Inputs) third-party-advisory

cve.org (CVE-2025-71320)

nvd.nist.gov (CVE-2025-71320)

Download JSON