Advisory Database
  • Advisories
  • Dependency Scanning
  1. pypi
  2. ›
  3. picklescan
  4. ›
  5. GHSA-fj43-3qmq-673f

GHSA-fj43-3qmq-673f: Picklescan failed to detect to some unsafe global function in Numpy library

April 7, 2025

An unsafe deserialization vulnerability in Python’s pickle module allows an attacker to bypass static analysis tools like Picklescan and execute arbitrary code during deserialization. This can be exploited by import some built-in function in Numpy library that indrectly call some dangerous function like exec() to execute some python code as a parameter, which the attacker can import dangerous library inside like os library and execute arbitrary OS commands.

References

  • github.com/advisories/GHSA-fj43-3qmq-673f
  • github.com/mmaitre314/picklescan
  • github.com/mmaitre314/picklescan/security/advisories/GHSA-fj43-3qmq-673f

Code Behaviors & Features

Detect and mitigate GHSA-fj43-3qmq-673f with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 0.0.25

Fixed versions

  • 0.0.25

Solution

Upgrade to version 0.0.25 or above.

Weakness

  • CWE-502: Deserialization of Untrusted Data

Source file

pypi/picklescan/GHSA-fj43-3qmq-673f.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:15:28 +0000.