picklescan - Remote Code Execution via Unblocked ctypes Module

An attacker crafts a malicious pickle file that chains `ctypes.WinDll`, `operator.itemgetter`, and `operator.methodcaller` to load `kernel32.dll` and call `WinExec` with an arbitrary command (e.g. `calc.exe`). Because picklescan does not flag `ctypes` as dangerous, the pickle file passes the scanner's checks. When a victim loads the pickle with `pickle.load()`, the deserialization triggers the chain and executes the attacker's command [ref_id=1]. This bypasses the sandbox protections and gadget-chain detection that picklescan is meant to enforce.

The picklescan library before version 0.0.33 does not include `ctypes` in its list of blocked/dangerous modules. Because `ctypes` provides a foreign function interface that can load DLLs, call C functions directly, and manipulate raw memory pointers, the scanner fails to flag pickle files that use `ctypes.WinDLL` to load `kernel32.dll` and invoke `WinExec` [ref_id=1].

The advisory states that picklescan before 0.0.33 fails to block the `ctypes` module. The fix (presumably in version 0.0.33) adds `ctypes` to the list of dangerous modules that the scanner checks. This prevents pickle files that reference `ctypes.WinDll` or similar ctypes constructs from passing the scan, closing the direct-syscall and raw-memory-access loophole that the original gadget-chain detection missed [ref_id=1].