PickleScan's deserialization logic improperly allows the pty.spawn function to be used by untrusted pickle data, because it is omitted from the software's list of unsafe globals. An attacker can embed a pickle payload that imports and calls pty.spawn, causing PickleScan to execute arbitrary system commands with the process's privileges. This flaw delivers a remote code execution capability that can compromise any system running the vulnerable version of the tool.

The vulnerability affects PickleScan versions prior to 0.0.33. Users running these releases are susceptible to exploitation if they process untrusted pickle files. No additional vendor or product variants are listed.

The CVSS score of 8.7 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is the delivery of malicious pickle files to be processed by PickleScan, which may occur through local file uploads or automated scan pipelines. Exploitation would allow an attacker to run arbitrary commands on the host, leading to full system compromise if no additional controls are in place.