GHSA-5rph-q42j-36j9

Source

https://github.com/advisories/GHSA-5rph-q42j-36j9

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5rph-q42j-36j9/GHSA-5rph-q42j-36j9.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5rph-q42j-36j9

Withdrawn

2026-06-18T14:40:53Z

Published

2026-06-17T18:35:56Z

Modified

2026-09-10T03:50:48Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Summary

Duplicate Advisory: Picklescan has pickle parsing logic flaw that leads to malicious pickle file bypass

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-9gvj-pp9x-gcfr. This link is maintained to preserve external references.

Original Description

picklescan before 0.0.27 contains a parsing logic error in the _list_globals function when handling STACK_GLOBAL opcodes, failing to track arguments in the correct range and allowing malicious pickle files to bypass detection. Attackers can craft pickle files with arguments at position zero to trigger unexpected exceptions and evade security scanning.

Database specific

{
    "cwe_ids":  [
        "CWE-391"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-06-18T14:40:53Z",
    "nvd_published_at":  "2026-06-17T17:16:41Z",
    "severity":  "CRITICAL"
}

References

Affected packages

PyPI / picklescan

Package

Name: picklescan; View open source insights on deps.dev
Purl: pkg:pypi/picklescan

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.0.1

0.0.2

0.0.3

0.0.4

0.0.5

0.0.6

0.0.7

0.0.8

0.0.9

0.0.10

0.0.11

0.0.12

0.0.13

0.0.14

0.0.15

0.0.16

0.0.17

0.0.18

0.0.19

0.0.20

0.0.21

0.0.22

0.0.23

0.0.24

0.0.25

0.0.26

0.0.27

0.0.28

0.0.29

0.0.30

0.0.31

0.0.32

0.0.33

0.0.34

0.0.35

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

Database specific

last_known_affected_version_range

"< 0.0.27"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5rph-q42j-36j9/GHSA-5rph-q42j-36j9.json"