Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: picklescan 1.0.4 Clear all filters
TI-2026-38869 CVE-2026-53873 · GHSA-7wx9-6375-f5wh

picklescan - Arbitrary Code Execution via profile.run() Blocklist Bypass

Priority HIGH 81

picklescan before 1.0.4 contains an incomplete blocklist for the profile module that fails to block the module-level profile.run() function, allowing attackers to achieve arbitrary code execution via exec().

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.0046 Published 2026-06-17 Fixed in 1.0.4 CWE-184
TI-2026-03009 CVE-2026-3490 · GHSA-vvpj-8cmc-gx39

picklescan - Universal Blocklist Bypass via pkgutil.resolve_name

Priority HIGH 82

picklescan before 1.0.4 fails to block pkgutil.resolve_name, allowing attackers to bypass the entire blocklist by resolving any dangerous function through indirect REDUCE calls.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00823 Published 2026-06-17 Fixed in 1.0.4 CWE-183