---
id: GHSA-fcqg-3mwf-cfcf
title: >-
  Duplicate Advisory: Picklescan is missing detection when calling built-in
  Python cProfile.runctx
summary: >-
  Duplicate Advisory: Picklescan is missing detection when calling built-in
  Python cProfile.runctx
severity: high
cvss: 8.1
cwe:
  - CWE-502
vendor: picklescan
product: picklescan
ecosystem: pip
affected:
  - picklescan < 0.0.30
patched:
  - picklescan 0.0.30
published: '2026-06-21'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T19:20:37Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-fcqg-3mwf-cfcf'
references:
  - url: >-
      https://github.com/mmaitre314/picklescan/security/advisories/GHSA-9w88-8rmg-7g2p
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-71378'
  - url: >-
      https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-undetected-cprofile-runctx-in-pickle-files
  - url: 'https://github.com/advisories/GHSA-fcqg-3mwf-cfcf'
tags:
  - ghsa
  - pip
ingestedAt: '2026-09-11T19:57:09.310Z'
---

## Overview

### Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-9w88-8rmg-7g2p. This link is maintained to preserve external references.

### Original Description

picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute arbitrary code. Malicious pickle files bypass picklescan detection and execute remote code when loaded via pickle.load().

## Affected packages

- `picklescan < 0.0.30`

## Remediation

Upgrade to a patched release:

- `picklescan 0.0.30`