{"id":"GHSA-fcqg-3mwf-cfcf","title":"Duplicate Advisory: Picklescan is missing detection when calling built-in Python cProfile.runctx","summary":"Duplicate Advisory: Picklescan is missing detection when calling built-in Python cProfile.runctx","severity":"high","cvss":8.1,"cwe":["CWE-502"],"vendor":"picklescan","product":"picklescan","ecosystem":"pip","affected":["picklescan < 0.0.30"],"patched":["picklescan 0.0.30"],"published":"2026-06-21","updated":"2026-09-11","sourceUpdated":"2026-09-11T19:20:37Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-fcqg-3mwf-cfcf","references":[{"url":"https://github.com/mmaitre314/picklescan/security/advisories/GHSA-9w88-8rmg-7g2p"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71378"},{"url":"https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-undetected-cprofile-runctx-in-pickle-files"},{"url":"https://github.com/advisories/GHSA-fcqg-3mwf-cfcf"}],"tags":["ghsa","pip"],"ingestedAt":"2026-09-11T19:57:09.310Z","slug":"GHSA-fcqg-3mwf-cfcf","body":"## Overview\n\n### Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-9w88-8rmg-7g2p. This link is maintained to preserve external references.\n\n### Original Description\n\npicklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute arbitrary code. Malicious pickle files bypass picklescan detection and execute remote code when loaded via pickle.load().\n\n## Affected packages\n\n- `picklescan < 0.0.30`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `picklescan 0.0.30`","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}