CVE-2026-56315: picklescan - Remote Code Execution via Unblocked Standard Library Modules
picklescan before 1.0.4 fails to block at least seven Python standard library modules (including uuid, osxsupport, aixsupport, pyrepl.pager, and imaplib) exposing eight functions that provide direct arbitrary command execution. Attackers can craft malicious pickle files importing these unblocked modules to achieve remote code execution while bypassing picklescan's safety validation entirely.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56315?
CVE-2026-56315 has a critical severity rating of 9.8.
How do I fix CVE-2026-56315?
To mitigate CVE-2026-56315, upgrade picklescan to version 1.0.4 or later.
What type of vulnerability is CVE-2026-56315?
CVE-2026-56315 is categorized as a Remote Code Execution vulnerability.
What are the affected functions in CVE-2026-56315?
CVE-2026-56315 exposes eight functions through unblocked Python standard library modules.
What is the impact of CVE-2026-56315?
The impact of CVE-2026-56315 allows attackers to execute arbitrary commands through crafted malicious pickle files.