GHSA-x843-g5mx-g377: Picklescan is vulnerable to RCE through missing detection when calling built-in python operator.methodcaller

December 29, 2025

Picklescan uses operator.methodcaller, which is a built-in python library function to execute remote pickle files.

References

github.com/advisories/GHSA-x843-g5mx-g377
github.com/mmaitre314/picklescan
github.com/mmaitre314/picklescan/commit/70c1c6c31beb6baaf52c8db1b6c3c0e84a6f9dab
github.com/mmaitre314/picklescan/pull/53
github.com/mmaitre314/picklescan/security/advisories/GHSA-x843-g5mx-g377

Code Behaviors & Features

Detect and mitigate GHSA-x843-g5mx-g377 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →