{"id":"GHSA-rmpp-8wf5-xx5q","title":"Duplicate Advisory: Picklescan vulnerable to Arbitrary File Writing","summary":"Duplicate Advisory: Picklescan vulnerable to Arbitrary File Writing","severity":"critical","cvss":9.8,"cwe":["CWE-502"],"vendor":"picklescan","product":"picklescan","ecosystem":"pip","affected":["picklescan < 0.0.33"],"patched":["picklescan 0.0.33"],"published":"2026-06-17","updated":"2026-06-18","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-rmpp-8wf5-xx5q","references":[{"url":"https://github.com/mmaitre314/picklescan/security/advisories/GHSA-m273-6v24-x4m4"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71321"},{"url":"https://www.vulncheck.com/advisories/picklescan-arbitrary-file-writing-via-distutils-module-bypass"},{"url":"https://github.com/advisories/GHSA-rmpp-8wf5-xx5q"}],"tags":["ghsa","pip"],"ingestedAt":"2026-06-29T14:31:47.206Z","slug":"GHSA-rmpp-8wf5-xx5q","body":"## Overview\n\n### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-m273-6v24-x4m4. This link is maintained to preserve external references.\n\n### Original Description\npicklescan before 0.0.33 contains an arbitrary file writing vulnerability that allows attackers to bypass the dangerous blocklist by using distutils.file_util.write_file. Attackers can construct malicious pickle objects to overwrite critical system files and achieve denial of service or remote code execution.\n\n## Affected packages\n\n- `picklescan < 0.0.33`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `picklescan 0.0.33`","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}