picklescan - Remote Code Execution via Incomplete Disallowed Inputs

A remote attacker crafts a malicious pickle file that uses `pydoc.locate` to dynamically resolve an arbitrary module (e.g., `os`) and `operator.methodcaller` to invoke a method on that module (e.g., `system`). When a victim deserializes the pickle with `pickle.load()`, the attacker's payload executes arbitrary commands on the victim's machine. The attack requires no authentication and can be delivered over any channel that causes the victim to load the pickle (e.g., email attachment, file upload, or network share). [ref_id=1]

The picklescan deny-list in versions before 0.0.33 only blocks specific functions from the `pydoc` and `operator` modules but omits `pydoc.locate` and `operator.methodcaller`. Because these two functions are not listed, picklescan treats pickle entries that use them as "Safe" or "Suspicious" rather than "Dangerous", allowing malicious pickles to bypass the scanner.

The advisory recommends upgrading the deny-list from a per-function block to a wildcard (`*`) for the `pydoc` and `operator` modules, so that any function from these modules is flagged as "Dangerous". This closes the gap because attackers can no longer introduce a new unlisted function from the same modules to bypass the scanner. The patch does not show the exact diff, but the remediation guidance is clear: block the entire module rather than maintaining a function allow-list. [ref_id=1]