What is GHSA-rmpp-8wf5-xx5q?

GHSA-rmpp-8wf5-xx5q is a security advisory published by GitHub Security Advisories with Critical severity. Duplicate Advisory: Picklescan vulnerable to Arbitrary File Writing

Why does GHSA-rmpp-8wf5-xx5q have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-rmpp-8wf5-xx5q?

GHSA-rmpp-8wf5-xx5q has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-rmpp-8wf5-xx5q?

GHSA-rmpp-8wf5-xx5q affects 1 product, including: pip/picklescan:\u003c 0.0.33.

⚠ Withdrawn by GitHub Security Advisories

Withdrawn: June 18, 2026

GHSA-rmpp-8wf5-xx5qCriticalCVSS 9.8Disclosed before NVD

Duplicate Advisory: Picklescan vulnerable to Arbitrary File Writing

Vendor

GitHub Security Advisories

Published

June 17, 2026

Last Modified

June 18, 2026

📋 Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-m273-6v24-x4m4. This link is maintained to preserve external references.

Original Description

picklescan before 0.0.33 contains an arbitrary file writing vulnerability that allows attackers to bypass the dangerous blocklist by using distutils.file_util.write_file. Attackers can construct malicious pickle objects to overwrite critical system files and achieve denial of service or remote code execution.

🎯 Affected products1

pip/picklescan:< 0.0.33

🔗 References (4)

https://github.com/mmaitre314/picklescan/security/advisories/GHSA-m273-6v24-x4m4
https://nvd.nist.gov/vuln/detail/CVE-2025-71321
https://www.vulncheck.com/advisories/picklescan-arbitrary-file-writing-via-distutils-module-bypass
https://github.com/advisories/GHSA-rmpp-8wf5-xx5q