CVE-2026-3490: picklescan - Universal Blocklist Bypass via pkgutil.resolve_name
picklescan before 1.0.4 fails to block pkgutil.resolvename, allowing attackers to bypass the entire blocklist by resolving any dangerous function through indirect REDUCE calls. Remote attackers can invoke any blocked function such as os.system, builtins.exec, or subprocess.call to achieve remote code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
picklescanto a version that resolves this vulnerability.Fixed in 1.0.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3490?
The severity of CVE-2026-3490 is critical with a CVSS score of 10.
How do I fix CVE-2026-3490?
To fix CVE-2026-3490, update picklescan to version 1.0.4 or later where the vulnerability is addressed.
What kind of attack can be performed using CVE-2026-3490?
Attackers can exploit CVE-2026-3490 to bypass the blocklist and execute dangerous functions like os.system or subprocess.call.
Which software is affected by CVE-2026-3490?
CVE-2026-3490 affects the picklescan software prior to version 1.0.4.
When was CVE-2026-3490 published?
CVE-2026-3490 was published on June 17, 2026.