---
id: CVE-2026-3490
title: picklescan - Universal Blocklist Bypass via pkgutil.resolve_name
summary: >-
  picklescan before 1.0.4 fails to block pkgutil.resolve_name, allowing
  attackers to bypass the entire blocklist by resolving any dangerous function
  through indirect REDUCE calls. Remote attackers can invoke any blocked
  function such as os…
severity: critical
cvss: 10
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-183
vendor: picklescan
product: picklescan
affected:
  - picklescan < 1.0.4
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-06-18T15:20:40.069385Z'
exploitAvailable: true
published: '2026-06-17'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:02:10.852Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-3490'
references:
  - url: >-
      https://github.com/mmaitre314/picklescan/security/advisories/GHSA-vvpj-8cmc-gx39
    label: GitHub Security Advisory (GHSA-vvpj-8cmc-gx39)
  - url: >-
      https://www.vulncheck.com/advisories/picklescan-universal-blocklist-bypass-via-pkgutil-resolve-name
    label: >-
      VulnCheck Advisory: picklescan - Universal Blocklist Bypass via
      pkgutil.resolve_name
tags:
  - cve.org
  - exploit-available
epss: 0.00823
epssPercentile: 0.5758
ingestedAt: '2026-11-08T14:51:22.453Z'
---

## Overview

picklescan before 1.0.4 fails to block pkgutil.resolve_name, allowing attackers to bypass the entire blocklist by resolving any dangerous function through indirect REDUCE calls. Remote attackers can invoke any blocked function such as os.system, builtins.exec, or subprocess.call to achieve remote code execution.

## Affected

- `picklescan < 1.0.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.