A malicious pickle file can embed calls to idlelib.pyshell.ModifiedInterpreter.runcode inside its __reduce__ method; when that file is deserialized with pickle.load(), the code runs with the privileges of the process loading it. This flaw permits arbitrary command execution in applications that use picklescan to load or process serialized data, such as PyTorch models and other Python objects, and is classified as a serialization vulnerability (CWE-502).

picklescan prior to version 0.0.30, specifically 0.0.26 and earlier, are affected. The issue is fixed in picklescan 0.0.30 and later releases.

The CVSS score of 7.6 indicates a high severity for this vulnerability. Although EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog, the possibility of executing arbitrary code when loading benign-looking files makes the risk substantial. The attack vector is file-based or supply‑chain: an attacker can deliver a crafted pickle file that triggers execution upon load. Any system that accepts pickle input from untrusted sources and uses picklescan to process it faces a direct threat of code execution and potential compromise of confidentiality, integrity, and availability.