picklescan before version 0.0.33 contains a flaw that allows attackers to bypass its deny‑list. The unprotected pydoc.locate and operator.methodcaller functions can be used to embed malicious payloads in pickle data. When an attacker supplies a crafted pickle file to a deserializing component, the application can execute arbitrary code in the context of the running process, as described by CWE-184.

The affected product is picklescan by mmaitre314. All releases prior to 0.0.33 are impacted. Systems that import and deserialize pickles using picklescan without additional input filtering remain vulnerable. The vulnerability exists in the core deserialization routine that accepts untrusted data.

The CVSS score of 9.3 indicates a severe risk, but the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Attackers would need remote access to send a malicious pickle to a service that uses picklescan, which is a typical remote code execution vector. The remote attacker can trigger the flaw by transmitting a specially crafted pickle file that takes advantage of the unfiltered pydoc.locate or operator.methodcaller paths.