Shivasurya

**Name of the Vulnerable Software and Affected Versions** picklescan versions prior to 0.0.35 **Description** Unsafe pickle deserialization allows unauthenticated attackers to read arbitrary server files and perform Server-Side Request Forgery (SSRF). The issue occurs because the application deserializes untrusted pickle data. Attackers can bypass blocklists designed to prevent Remote Code Execution (RCE) by chaining the `io.FileIO` function to open local files and the `urllib.request.urlopen` function to stream the file content as a POST request body to an external server. This allows for the exfiltration of sensitive data, such as `/etc/passwd`. **Recommendations** Update to version 0.0.35 or later.