Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🐍 PyPI
Not in CISA KEV

GHSA-vqmv-47xg-9wpr — picklescan

Fix: mmaitre314/picklescan#53

GHSA-vqmv-47xg-9wpr is a remote code execution vulnerability in picklescan. A fix is available for picklescan — see the affected versions and patch details below.

Picklescan missing detection when calling pty.spawn

Published
Dec 29, 2025
Updated
Dec 29, 2025
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Dec 29, 2025 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected
🐍picklescan

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

Summary

Using pty.spawn, which is a built-in python library function to execute arbitrary commands on the host system.

Details

The attack payload executes in the following steps: First, the attacker craft the payload by calling to pty.spawn function in the __reduce__ method. Then the victim attempts to use picklescan to scan the pickle file for issues and sees this -

----------- SCAN SUMMARY -----------
Scanned files: 1
Infected files: 0
Dangerous globals: 0

The victim proceeds to load the pickle file and execute attacker-injected arbitrary code.

PoC

class PtyExploit:
  def __reduce__(self):
    return (pty.spawn, (["/bin/sh", "-c", "id; exit"],))

Impact

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models. What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded. Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

Collaborators

https://github.com/ajohnston9 https://github.com/geo-lit

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐍PyPIpicklescanall versions0.0.33pip install --upgrade 'picklescan==0.0.33'

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for picklescan, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update picklescan to 0.0.33 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-vqmv-47xg-9wpr is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

  4. How O3 protects you

    O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-vqmv-47xg-9wpr can be triaged on real exposure rather than presence alone.

Tailored to GHSA-vqmv-47xg-9wpr. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

### Summary Using pty.spawn, which is a built-in python library function to execute arbitrary commands on the host system. ### Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to `pty.spawn` function in the `__reduce__` method. Then the victim attempts to use picklescan to scan the pickle file for issues and sees this - ``` ----------- SCAN SUMMARY ----------- Scanned files: 1 Infected files: 0 Dangerous globals: 0 ``` The victim proceeds to load the pickle file and execute attacker-injected arbitrary code. ### PoC ``` class PtyExpl
O3 Security · Impact-Aware SCA

Is GHSA-vqmv-47xg-9wpr in your dependencies?

O3 Security finds GHSA-vqmv-47xg-9wpr across PyPI dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.

Scan my dependencies How O3 SCA works
GHSA-vqmv-47xg-9wpr: picklescan | O3 Security