Vulnerability Description
picklescan before 1.0.4 fails to block pkgutil.resolve_name, allowing attackers to bypass the entire blocklist by resolving any dangerous function through indirect REDUCE calls. Remote attackers can invoke any blocked function such as os.system, builtins.exec, or subprocess.call to achieve remote code execution.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/mmaitre314/picklescan/security/advisories/GHSA-vvpj-8cmc-gx39
- https://www.vulncheck.com/advisories/picklescan-universal-blocklist-bypass-via-p
- https://github.com/mmaitre314/picklescan/security/advisories/GHSA-vvpj-8cmc-gx39
FAQ
What is CVE-2026-3490?
CVE-2026-3490 is a vulnerability with a CVSS score of 10.0 (CRITICAL). picklescan before 1.0.4 fails to block pkgutil.resolve_name, allowing attackers to bypass the entire blocklist by resolving any dangerous function through indirect REDUCE calls. Remote attackers can i...
How severe is CVE-2026-3490?
CVE-2026-3490 has been rated CRITICAL with a CVSS base score of 10.0/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-3490?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.