picklescan versions before 0.0.29 do not detect the use of profile.Profile.runctx during pickle deserialization. If an attacker supplies a specially crafted pickle file that calls profile.Profile.runctx via its reduce method, the function is executed and arbitrary code runs on the system that loads the file. The flaw provides direct remote code execution because the malicious payload runs with the privileges of the user executing picklescan.

All installations of picklescan earlier than version 0.0.29 are vulnerable. This includes any user or service that loads pickle files using the default deserialization routines of this package.

The CVSS score of 7.6 indicates a high severity impact. Because the attack requires the attacker to supply a pickle file that the target processes, the exploit vector is likely remote delivery to an application that relies on picklescan. No EPSS score is available, and this vulnerability is not yet included in the CISA KEV catalog; however, remote code execution remains a high‑risk threat. An attacker who succeeds can fully compromise the affected system, execute arbitrary commands, and maintain persistence if desired.