GHSA-3vg9-h568-4w9m: picklescan: RCE bypass via idlelib SetText evasion

### Summary Using idlelib.debugobj.ObjectTreeItem.SetText, which is a built-in python library function to execute remote pickle file. ### Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to idlelib.debugobj.ObjectTreeItem.SetText function in reduce method Then when the victim after checking whether the pickle file is safe by using Picklescan library and this library doesn't dectect any dangerous functions, decide to pickle.load() this malicious pickle file, thus lead to remote code execution. ### PoC ``` class EvilDebugobjSetText: def __reduce__(self): from idlelib.debugobj import ObjectTreeItem # ObjectTreeItem(..., setfunction=print).SetText(cmd) return ObjectTreeItem("label", None, print).SetText, ("__import__('os').system('whoami')",) ``` ### Impact Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models. What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded. Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects. ### Corresponding https://github.com/FredericDT https://github.com/Qhaoduoyu

An attacker publishes a trojanized version of a popular open-source PyTorch model (e.g., a fine-tuned LLM or image classifier) to HuggingFace or GitHub. The model file contains the PoC payload in its `__reduce__` method, calling `idlelib.debugobj.ObjectTreeItem.SetText` with a reverse shell command. An ML engineer or automated pipeline downloads the model and runs picklescan — which returns clean. Trusting the verdict, they execute `torch.load()`, triggering RCE on the inference server or GPU training node. In a CI/CD variant, the poisoned model enters the artifact registry and propagates to production model serving, giving the attacker persistent access to inference infrastructure.