{"id":"GHSA-mg57-j93w-g3c7","title":"Duplicate Advisory: Picklescan has a missing detection when calling built-in python profile.Profile.runctx","summary":"Duplicate Advisory: Picklescan has a missing detection when calling built-in python profile.Profile.runctx","severity":"high","cvss":8.1,"cwe":["CWE-502"],"vendor":"picklescan","product":"picklescan","ecosystem":"pip","affected":["picklescan < 0.0.29"],"patched":["picklescan 0.0.29"],"published":"2026-06-23","updated":"2026-09-23","sourceUpdated":"2026-09-23T18:16:00Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-mg57-j93w-g3c7","references":[{"url":"https://github.com/mmaitre314/picklescan/security/advisories/GHSA-6vqj-c2q5-j97w"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71341"},{"url":"https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-undetected-profile-profile-runctx"},{"url":"https://github.com/advisories/GHSA-mg57-j93w-g3c7"}],"tags":["ghsa","pip"],"ingestedAt":"2026-09-23T18:29:33.148Z","slug":"GHSA-mg57-j93w-g3c7","body":"## Overview\n\n### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-6vqj-c2q5-j97w. This link is maintained to preserve external references.\n\n### Original Description\npicklescan before 0.0.29 fails to detect the profile.Profile.runctx function when analyzing pickle files, allowing attackers to embed undetected malicious code. Remote attackers can craft malicious pickle files using profile.Profile.runctx in the reduce method to achieve remote code execution when the pickle file is loaded.\n\n## Affected packages\n\n- `picklescan < 0.0.29`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `picklescan 0.0.29`","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}