GHSA-955r-x9j8-7rhh: Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.methodcaller

December 30, 2025

Picklescan uses _operator.methodcaller, which is a built-in python library function to execute remote pickle files.

References

github.com/advisories/GHSA-955r-x9j8-7rhh
github.com/mmaitre314/picklescan
github.com/mmaitre314/picklescan/commit/f2dea43e0c838e09ace1e62994143254b51de927
github.com/mmaitre314/picklescan/releases/tag/v0.0.34
github.com/mmaitre314/picklescan/security/advisories/GHSA-955r-x9j8-7rhh

Code Behaviors & Features

Detect and mitigate GHSA-955r-x9j8-7rhh with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →