GHSA-fcqg-3mwf-cfcf

Source

https://github.com/advisories/GHSA-fcqg-3mwf-cfcf

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-fcqg-3mwf-cfcf/GHSA-fcqg-3mwf-cfcf.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-fcqg-3mwf-cfcf

Withdrawn

2026-09-11T19:20:36Z

Published

2026-06-21T15:31:23Z

Modified

2026-09-11T19:30:05Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
7.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Duplicate Advisory: Picklescan is missing detection when calling built-in Python cProfile.runctx

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-9w88-8rmg-7g2p. This link is maintained to preserve external references.

Original Description

picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute arbitrary code. Malicious pickle files bypass picklescan detection and execute remote code when loaded via pickle.load().

Database specific

{
    "cwe_ids":  [
        "CWE-502"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-09-11T19:20:36Z",
    "nvd_published_at":  "2026-06-21T14:16:23Z",
    "severity":  "HIGH"
}

References

Affected packages

PyPI / picklescan

Package

Name: picklescan; View open source insights on deps.dev
Purl: pkg:pypi/picklescan

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.0.30

Affected versions

0.*

0.0.1

0.0.2

0.0.3

0.0.4

0.0.5

0.0.6

0.0.7

0.0.8

0.0.9

0.0.10

0.0.11

0.0.12

0.0.13

0.0.14

0.0.15

0.0.16

0.0.17

0.0.18

0.0.19

0.0.20

0.0.21

0.0.22

0.0.23

0.0.24

0.0.25

0.0.26

0.0.27

0.0.28

0.0.29

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-fcqg-3mwf-cfcf/GHSA-fcqg-3mwf-cfcf.json"