PickleScan - Unsafe Globals Check Bypass via pty.spawn Function

An attacker crafts a pickle payload that references `pty.spawn` (a function that spawns a shell) and embeds it in a PyTorch model or ZIP archive. When PickleScan (before 0.0.33) scans the file, it flags `pty.spawn` as only "suspicious" rather than "dangerous", so the payload passes the security check. If the file is later loaded (e.g., via `pickle.load`), `pty.spawn` executes arbitrary commands on the victim's system. [ref_id=1]

The vulnerability is in `src/picklescan/scanner.py` where the `_unsafe_globals` dictionary did not include `pty.spawn`. The patch adds `"pty": "spawn"` to that list.

The patch adds `"pty": "spawn"` to the `_unsafe_globals` dictionary in `scanner.py`. This ensures that `pty.spawn` is classified as a dangerous global, causing PickleScan to block pickle payloads that attempt to use it. Without this entry, the function was only flagged as "suspicious" and did not prevent the payload from being considered safe. [ref_id=1]