{"id":"GHSA-gq8p-2329-gh3x","title":"Duplicate Advisory: Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.fetch_completions","summary":"Duplicate Advisory: Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.fetch_completions","severity":"high","cvss":8.1,"cwe":["CWE-502"],"vendor":"picklescan","product":"picklescan","ecosystem":"pip","affected":["picklescan < 0.0.29"],"patched":["picklescan 0.0.29"],"published":"2026-06-23","updated":"2026-09-23","sourceUpdated":"2026-09-23T18:13:30Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-gq8p-2329-gh3x","references":[{"url":"https://github.com/mmaitre314/picklescan/security/advisories/GHSA-7cq8-mj8x-j263"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71376"},{"url":"https://www.vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-undetected-idlelib-autocomplete-autocomplete-fetch-completions"},{"url":"https://github.com/advisories/GHSA-gq8p-2329-gh3x"}],"tags":["ghsa","pip"],"ingestedAt":"2026-09-23T18:29:33.149Z","slug":"GHSA-gq8p-2329-gh3x","body":"## Overview\n\n### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-7cq8-mj8x-j263. This link is maintained to preserve external references.\n\n### Original Description\npicklescan before 0.0.29 fails to detect malicious pickle files using idlelib.autocomplete.AutoComplete.fetch_completions in reduce methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when loaded by victims.\n\n## Affected packages\n\n- `picklescan < 0.0.29`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `picklescan 0.0.29`","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}