picklescan przed wersją 0.0.30 vulnerabilities

The vulnerability in picklescan before version 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to bypass scanning and execute arbitrary code when a malicious pickle file is loaded via pickle.load().

A vulnerability in picklescan before version 0.0.30 allows bypassing detection of malicious pickle files. Attackers can use the idlelib.pyshell.ModifiedInterpreter.runcommand method in reduce functions to hide code that executes remote commands when the file is loaded by the victim.

The vulnerability in picklescan before version 0.0.28 fails to detect malicious pickle files that invoke the torch.utils._config_module.load_config function within reduce methods. Attackers can craft pickle files embedding arbitrary code that evades detection but executes during pickle.load, enabling remote code execution in supply chain attacks.