PatchSiren cyber security CVE debrief
CVE-2026-3490 picklescan CVE debrief
CVE-2026-3490 is a critical vulnerability in the picklescan library, which fails to block the `pkgutil.resolve_name` function. This oversight enables attackers to bypass the entire blocklist by resolving any dangerous function through indirect REDUCE calls, potentially leading to remote code execution. The vulnerability has a CVSS score of 10, indicating the highest severity. Remote attackers can exploit this vulnerability to invoke blocked functions such as `os.system`, `builtins.exec`, or `subprocess.call`, achieving remote code execution. Organizations using picklescan versions before 1.0.4 are urged to update to the latest version to mitigate this risk.
- Vendor
- picklescan
- Product
- Unknown
- CVSS
- CRITICAL 10
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-17
- Original CVE updated
- 2026-06-18
- Advisory published
- 2026-06-17
- Advisory updated
- 2026-06-18
Who should care
Developers and administrators using the picklescan library, especially in environments where remote code execution could have significant impacts, should prioritize updating to version 1.0.4 or later. This vulnerability's critical severity and potential for remote code execution make it a high-priority concern for security teams.
Technical summary
The picklescan library, prior to version 1.0.4, is vulnerable to a blocklist bypass due to its failure to properly block the `pkgutil.resolve_name` function. This function can be exploited through indirect REDUCE calls, allowing attackers to invoke dangerous functions that were intended to be blocked. The vulnerability is characterized by its high CVSS score of 10, indicating a critical severity level. The attack vector is network-based, with low attack complexity and no prerequisites for exploitation.
Defensive priority
high
Recommended defensive actions
- Update picklescan to version 1.0.4 or later
- Review and restrict usage of `pkgutil.resolve_name` in applications
- Implement additional security measures to monitor and limit REDUCE calls
- Conduct regular vulnerability assessments to identify outdated libraries
- Consider alternative libraries with more robust security features
- Enhance network security to detect and prevent exploitation attempts
Evidence notes
The information provided is based on data from official sources, including the CVE record and NVD details. The vulnerability's existence and details have been confirmed by multiple sources, including Vulncheck and GitHub advisories.
Official resources
CVE-2026-3490 was published on 2026-06-17T17:16:50.727Z and modified on 2026-06-18T17:16:30.627Z.