PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-3490 picklescan CVE debrief

CVE-2026-3490 is a critical vulnerability in the picklescan library, which fails to block the `pkgutil.resolve_name` function. This oversight enables attackers to bypass the entire blocklist by resolving any dangerous function through indirect REDUCE calls, potentially leading to remote code execution. The vulnerability has a CVSS score of 10, indicating the highest severity. Remote attackers can exploit this vulnerability to invoke blocked functions such as `os.system`, `builtins.exec`, or `subprocess.call`, achieving remote code execution. Organizations using picklescan versions before 1.0.4 are urged to update to the latest version to mitigate this risk.

Vendor
picklescan
Product
Unknown
CVSS
CRITICAL 10
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-17
Original CVE updated
2026-06-18
Advisory published
2026-06-17
Advisory updated
2026-06-18

Who should care

Developers and administrators using the picklescan library, especially in environments where remote code execution could have significant impacts, should prioritize updating to version 1.0.4 or later. This vulnerability's critical severity and potential for remote code execution make it a high-priority concern for security teams.

Technical summary

The picklescan library, prior to version 1.0.4, is vulnerable to a blocklist bypass due to its failure to properly block the `pkgutil.resolve_name` function. This function can be exploited through indirect REDUCE calls, allowing attackers to invoke dangerous functions that were intended to be blocked. The vulnerability is characterized by its high CVSS score of 10, indicating a critical severity level. The attack vector is network-based, with low attack complexity and no prerequisites for exploitation.

Defensive priority

high

Recommended defensive actions

  • Update picklescan to version 1.0.4 or later
  • Review and restrict usage of `pkgutil.resolve_name` in applications
  • Implement additional security measures to monitor and limit REDUCE calls
  • Conduct regular vulnerability assessments to identify outdated libraries
  • Consider alternative libraries with more robust security features
  • Enhance network security to detect and prevent exploitation attempts

Evidence notes

The information provided is based on data from official sources, including the CVE record and NVD details. The vulnerability's existence and details have been confirmed by multiple sources, including Vulncheck and GitHub advisories.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-3490 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-3490

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-3490 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-3490

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.