picklescan - Remote Code Execution via Undetected profile.Profile.runctx

An attacker crafts a malicious pickle file whose `__reduce__` method returns `profile.Profile.runctx` along with attacker-controlled arguments (a Profile instance, a payload string, and empty dictionaries) [ref_id=1]. Picklescan 0.0.28 and earlier do not flag `Profile.runctx` as dangerous, so the file passes the scan. When the victim subsequently calls `pickle.load()` on the file, Python executes `Profile.runctx` with the embedded payload (`__import__('os').system('whoami')`), achieving remote code execution.

The advisory identifies that Picklescan before version 0.0.29 fails to detect `profile.Profile.runctx` when analyzing pickle files [ref_id=1]. The vulnerable code path is the `__reduce__` method of the attacker's class, which returns `Profile.runctx` as the callable to execute during unpickling.

The advisory does not include a patch diff, but the fix (released in Picklescan 0.0.29) adds `profile.Profile.runctx` to the list of dangerous functions that Picklescan detects during pickle file analysis [ref_id=1]. This ensures that any pickle file referencing `Profile.runctx` in a `__reduce__` call is flagged as unsafe before the user loads it with `pickle.load()`.