PT-2026-51510 · Picklescan · Picklescan

Yash2998Chhabria · Publicado 2026-06-23 · Atualizado 2026-06-23 · CVE-2026-56315

Mitre

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

picklescan before 1.0.4 fails to block at least seven Python standard library modules (including uuid, osx support, aix support, pyrepl.pager, and imaplib) exposing eight functions that provide direct arbitrary command execution. Attackers can craft malicious pickle files importing these unblocked modules to achieve remote code execution while bypassing picklescan's safety validation entirely.

Exploit

Correção

Incomplete List of Disallowed Inputs

Enumeração de Fraquezas

CWE-184

Identificadores relacionados

CVE-2026-56315

Produtos afetados

Picklescan

Referências · 3

• 🔥 https://github.com/mmaitre314/picklescan/security/advisories/GHSA-g38g-8gr9-h9xp · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-56315 · Nota de Segurança
• https://vulncheck.com/advisories/picklescan-remote-code-execution-via-unblocked-standard-library-modules · Nota