picklescan PyPI Package <= 0.0.32 Vulnerable: Upgrade Now
The picklescan package before version 0.0.33 contains an arbitrary file writing vulnerability that allows attackers to bypass the dangerous blocklist and overwrite critical system files, potentially leading to denial of service or remote code execution.
What happened
Multiple independent sources have confirmed that versions of the picklescan package prior to 0.0.33 contain an arbitrary file writing vulnerability. This vulnerability allows attackers to bypass the dangerous blocklist and overwrite critical system files, potentially leading to denial of service or remote code execution. The vulnerability is tracked under GHSA-M273-6V24-X4M4 and GHSA-RMPP-8WF5-XX5Q.
To assess your exposure, check if your software or dependencies include picklescan version 0.0.32 or earlier. If so, you are potentially vulnerable. The recommended action is to upgrade to picklescan version 0.0.33 or later to mitigate the vulnerability. For more details, consult the primary sources: [GHSA-4mpj-78p6-rj59](https://github.com/advisories/GHSA-4mpj-78p6-rj59), [GHSA-5rph-q42j-36j9](https://github.com/advisories/GHSA-5rph-q42j-36j9), [GHSA-6v84-v468-3c7f](https://github.com/advisories/GHSA-6v84-v468-3c7f), [GHSA-7f79-rvx6-vxc4](https://github.com/advisories/GHSA-7f79-rvx6-vxc4), and [GHSA-rmpp-8wf5-xx5q](https://github.com/advisories/GHSA-rmpp-8wf5-xx5q).
How 0Day mitigates this
picklescan is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.