NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐍 PyPI
Not in CISA KEV

Picklescan missing detection when calling pty.spawnGHSA-vqmv-47xg-9wpr

Fix: mmaitre314/picklescan#53

GHSA-vqmv-47xg-9wpr is a remote code execution vulnerability in picklescan. A fix is available for picklescan — see the affected versions and patch details below.

Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Dec 29, 2025 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected
🐍picklescan

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

Summary

Using pty.spawn, which is a built-in python library function to execute arbitrary commands on the host system.

Details

The attack payload executes in the following steps: First, the attacker craft the payload by calling to pty.spawn function in the __reduce__ method. Then the victim attempts to use picklescan to scan the pickle file for issues and sees this -

----------- SCAN SUMMARY -----------
Scanned files: 1
Infected files: 0
Dangerous globals: 0

The victim proceeds to load the pickle file and execute attacker-injected arbitrary code.

PoC

class PtyExploit:
  def __reduce__(self):
    return (pty.spawn, (["/bin/sh", "-c", "id; exit"],))

Impact

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models. What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded. Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

Collaborators

https://github.com/ajohnston9 https://github.com/geo-lit

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐍PyPIpicklescanall versions0.0.33pip install --upgrade 'picklescan==0.0.33'

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for picklescan, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update picklescan to 0.0.33 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-vqmv-47xg-9wpr is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Summary Using pty.spawn, which is a built-in python library function to execute arbitrary commands on the host system. ### Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to `pty.spawn` function in the `__reduce__` method. Then the victim attempts to use picklescan to scan the pickle file for issues and sees this - ``` ----------- SCAN SUMMARY ----------- Scanned files: 1 Infected files: 0 Dangerous globals: 0 ``` The victim proceeds to load the pickle file and execute attacker-injected arbitrary code. ### PoC ``` class PtyExpl
O3 Security · Impact-Aware SCA

Is GHSA-vqmv-47xg-9wpr in your dependencies?

Find it across PyPI, including transitive dependencies.

Scan my dependencies How O3 SCA works
Picklescan missing detection when calling pty.spawn