PT-2026-51510 · Picklescan · Picklescan

Yash2998Chhabria · Published 2026-06-23 · Updated 2026-06-23 · CVE-2026-56315

Mitre

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

picklescan before 1.0.4 fails to block at least seven Python standard library modules (including uuid, osx support, aix support, pyrepl.pager, and imaplib) exposing eight functions that provide direct arbitrary command execution. Attackers can craft malicious pickle files importing these unblocked modules to achieve remote code execution while bypassing picklescan's safety validation entirely.

Exploit

Fix

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-184

Related Identifiers

CVE-2026-56315

Affected Products

Picklescan

References · 3

• 🔥 https://github.com/mmaitre314/picklescan/security/advisories/GHSA-g38g-8gr9-h9xp · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-56315 · Security Note
• https://vulncheck.com/advisories/picklescan-remote-code-execution-via-unblocked-standard-library-modules · Note