Executive Summary

This vulnerability is a Protection Mechanism Failure in the mmaitre314 picklescan tool (versions up to 0.0.30) that allows a remote attacker to bypass the unsafe globals check. The scanner only performs an exact match for module names, so an attacker can exploit this by using submodules of dangerous packages (for example, 'asyncio.unix_events' instead of 'asyncio'). This causes the scanner to incorrectly consider a malicious file as safe, which when loaded after scanning, can lead to execution of malicious code.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to execute malicious code remotely by bypassing the safety checks of the picklescan scanner. This could lead to unauthorized code execution on your system, potentially compromising system integrity, confidentiality, and availability.

Useful 0 Not Useful 0