GHSA-fh2f-24rh-r2vq

Source

https://github.com/advisories/GHSA-fh2f-24rh-r2vq

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-fh2f-24rh-r2vq/GHSA-fh2f-24rh-r2vq.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-fh2f-24rh-r2vq

Withdrawn

2026-09-11T19:27:48Z

Published

2026-06-21T15:31:23Z

Modified

2026-09-11T19:45:08Z

Severity

7.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Duplicate Advisory: Picklescan missing detection when calling built-in python library function timeit.timeit()

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-v7x6-rv5q-mhwc. This link is maintained to preserve external references.

Original Description

picklescan before 0.0.25 fails to detect malicious pickle files that use timeit.timeit() in the reduce method, allowing remote code execution. Attackers can craft pickle files that import dangerous libraries like os and execute arbitrary system commands, which evade picklescan detection and execute when pickle.load() is called.

Database specific

{
    "cwe_ids":  [
        "CWE-184"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-09-11T19:27:48Z",
    "nvd_published_at":  "2026-06-21T14:16:22Z",
    "severity":  "HIGH"
}

References

Affected packages

PyPI / picklescan

Package

Name: picklescan; View open source insights on deps.dev
Purl: pkg:pypi/picklescan

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.0.25

Affected versions

0.*

0.0.1

0.0.2

0.0.3

0.0.4

0.0.5

0.0.6

0.0.7

0.0.8

0.0.9

0.0.10

0.0.11

0.0.12

0.0.13

0.0.14

0.0.15

0.0.16

0.0.17

0.0.18

0.0.19

0.0.20

0.0.21

0.0.22

0.0.23

0.0.24

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-fh2f-24rh-r2vq/GHSA-fh2f-24rh-r2vq.json"