CVE-2026-56315CWE-184

picklescan - Remote Code Execution via Unblocked Standard Library Modules

Critical · published June 23, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
66.5
In the wild
Unconfirmed
What it is

picklescan before 1.0.4 fails to block at least seven Python standard library modules (including uuid, _osx_support, _aix_support, _pyrepl.pager, and imaplib) exposing eight functions that provide direct arbitrary command execution. Attackers can craft malicious pickle files importing these unblocked modules to achieve remote code execution while bypassing picklescan's safety validation entirely.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01147 · 66.5th percentile
Weakness
CWE-184 · Incomplete List of Disallowed Inputs
Published
2026-06-23T12:13Z
EPSS history
Timeline
  • 23 JUN 12:13Z
    picklescan - Remote Code Execution via Unblocked Standard Library Modules
    cvelistv5