Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2026-3490 critical CVSS 10.0

Vulnerability in picklescan (CVE-2026-3490)

Summary

Vulnerability in picklescan (CVE-2026-3490). Successful exploitation can lead to full system takeover. Exploitable via pkgutil.resolve_name. Mitigation: upgrade to 1.0.4 or later.

Original description

The description as published by the source.

Summary

pkgutil.resolve_name() is a Python stdlib function that resolves any "module:attribute" string to the corresponding Python object at runtime. By using pkgutil.resolve_name as the first REDUCE call in a pickle, an attacker can obtain a reference to ANY blocked function (e.g., os.system, builtins.exec, subprocess.call) without that function appearing in the pickle's opcodes. picklescan only sees pkgutil.resolve_name (which is not blocked) and misses the actual dangerous function entirely.

This defeats picklescan's entire blocklist concept — every single entry in _unsafe_globals can be bypassed.

Severity

Critical (CVSS 10.0) — Universal bypass of all blocklist entries. Any blocked function can be invoked.

Affected Versions

  • picklescan <= 1.0.3 (all versions including latest)

Details

How It Works

A pickle file uses two chained REDUCE calls:

1. STACK_GLOBAL: push pkgutil.resolve_name
2. REDUCE: call resolve_name("os:system") → returns os.system function object
3. REDUCE: call the returned function("malicious command") → RCE

picklescan's opcode scanner sees:

  • STACK_GLOBAL with module=pkgutil, name=resolve_name → NOT in blocklist → CLEAN
  • The second REDUCE operates on a stack value (the return of the first call), not on a global import → invisible to scanner

The string "os:system" is just data (a SHORT_BINUNICODE argument to the first REDUCE) — picklescan does not analyze REDUCE arguments, only…

Source: GitHub Security Advisories (Global) NVD GitHub Advisory

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2026-3490 has been found in picklescan.
Attackers can target a specific entry point like pkgutil.resolve_name over the network to misuse the product.
Successful exploitation can lead to full system takeover. CVSS score: 10.0/10.
What to do: upgrade picklescan to 1.0.4 or later.
If unsure, ask your IT team or search "picklescan CVE-2026-3490" on the vendor's site.

CVE-2026-3490 (picklescan) — CWE-183 / CVSS v3 10.0
Attack vector: remote (network-reachable) / unauthenticated / no user interaction
Attack surface: pkgutil.resolve_name / os.system / builtins.exec / subprocess.call
Patched: 1.0.4 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

A vulnerability (CWE-183) exists in picklescan. Attackers reach the vulnerable code path via pkgutil.resolve_name without authentication.

📍 Affected scope

Check the vendor advisory for the affected versions of picklescan. Attack surface: pkgutil.resolve_name / os.system / builtins.exec / subprocess.call.

🔥 Severity

Severity: Critical (CVSS 10.0/10). Successful exploitation can lead to full system takeover.

🔧 How to fix

Update to 1.0.4.

🛡️ Workaround

Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'picklescan' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposure identify 
    grep -r 'picklescan' . | grep -v node_modules

    リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で picklescan を grep し、稼働しているサービス・バージョンを把握する。

  2. 2
    Apply patch patch 
    Upgrade picklescan to 1.0.4

    ステージング環境で 1.0.4 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。

  3. 3
    Post-deployment verification verify 
    Confirm patched version is live in production

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

pip picklescan
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4"}]}]
PyPI picklescan
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4"}]}]

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details