Vulnerability Description
picklescan before 1.0.4 fails to block at least seven Python standard library modules (including uuid, _osx_support, _aix_support, _pyrepl.pager, and imaplib) exposing eight functions that provide direct arbitrary command execution. Attackers can craft malicious pickle files importing these unblocked modules to achieve remote code execution while bypassing picklescan's safety validation entirely.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/mmaitre314/picklescan/security/advisories/GHSA-g38g-8gr9-h9xp
- https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-unbloc
- https://github.com/mmaitre314/picklescan/security/advisories/GHSA-g38g-8gr9-h9xp
FAQ
What is CVE-2026-56315?
CVE-2026-56315 is a vulnerability with a CVSS score of 9.8 (CRITICAL). picklescan before 1.0.4 fails to block at least seven Python standard library modules (including uuid, _osx_support, _aix_support, _pyrepl.pager, and imaplib) exposing eight functions that provide dir...
How severe is CVE-2026-56315?
CVE-2026-56315 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-56315?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.