Description
picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute arbitrary code. Malicious pickle files bypass picklescan detection and execute remote code when loaded via pickle.load().
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
picklescan picklescan
Default version status: unaffected
0 to < 0.0.30affected0.0.30unaffected
pkg:pypi/picklescan