GHSA-93mv-x874-956g: Picklescan Vulnerable to Exfiltration via DNS via linecache and ssl.get_server_certificate

April 7, 2025

Picklescan does not detect malicious pickles that exfiltrate sensitive information via DNS after deserialization.

References

github.com/advisories/GHSA-93mv-x874-956g
github.com/mmaitre314/picklescan
github.com/mmaitre314/picklescan/pull/40
github.com/mmaitre314/picklescan/security/advisories/GHSA-93mv-x874-956g

Code Behaviors & Features

Detect and mitigate GHSA-93mv-x874-956g with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →