Security

Report a vulnerability

SECURITY.md

Security Policy

Reporting a Vulnerability

Create a draft advisory to notify of vulnerabilities, false positives, false negatives, etc.

profile.run blocklist mismatch allows exec() bypass
GHSA-7wx9-6375-f5wh published Mar 2, 2026 by mmaitre314

Critical
pkgutil.resolve_name universal blocklist bypass
GHSA-vvpj-8cmc-gx39 published Mar 2, 2026 by mmaitre314

Critical
Multiple stdlib modules with direct RCE not in blocklist
GHSA-g38g-8gr9-h9xp published Mar 2, 2026 by mmaitre314

Critical
Arbitrary file create using logging.FileHandler
GHSA-m7j5-r2p5-c39r published Feb 2, 2026 by mmaitre314

Moderate
Arbitrary file read using `io.FileIO`
GHSA-9726-w42j-3qjr published Jan 7, 2026 by mmaitre314

High
Arbitrary File Writing
GHSA-m273-6v24-x4m4 published Dec 26, 2025 by mmaitre314

High
ctypes not being blocked
GHSA-4675-36f9-wf6r published Dec 26, 2025 by mmaitre314

Critical
Incomplete List of Disallowed Inputs in picklescan
GHSA-84r2-jw7c-4r5q published Dec 26, 2025 by mmaitre314

Critical
Missing detection when calling pty.spawn
GHSA-vqmv-47xg-9wpr published Dec 26, 2025 by mmaitre314

Moderate
Bypassing Unsafe Globals Check using pty.spawn
GHSA-hgrh-qx5j-jfwx published Dec 26, 2025 by mmaitre314

High

Learn more about advisories related to mmaitre314/picklescan in the GitHub Advisory Database