PyPI/picklescan CVE-2026-53872: high 7.5, EPSS 0.51%
picklescan has Arbitrary file read using `io.FileIO`
Action: Upgrade picklescan to 0.0.35 or later.
pip install picklescan==0.0.35Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.0.35 | - |
Fixed versions
| 0.0.35 |
Sources
- osv: GHSA-9726-w42j-3qjr
- https://github.com/mmaitre314/picklescan/security/advisories/GHSA-9726-w42j-3qjr
- https://nvd.nist.gov/vuln/detail/CVE-2026-53872
- https://github.com/mmaitre314/picklescan/pull/55
- https://github.com/mmaitre314/picklescan/commit/a01c58d5dd7960db557b849817c0ab83ab111ef1
- https://github.com/mmaitre314/picklescan
- https://github.com/mmaitre314/picklescan/releases/tag/v0.0.35
- https://www.vulncheck.com/advisories/picklescan-arbitrary-file-read-via-unsafe-pickle-deserialization
CVE-2026-53872 · published · modified · JSON