picklescan versions before 0.0.30 ignore malicious content in pickle payloads that use the standard library function idlelib.run.Executive.runcode during deserialization; the code runs automatically inside pickle.load, delivering arbitrary‑code execution whenever an attacker delivers a crafted file. This flaw, classified as CWE‑502, can be used to compromise systems handling PyTorch models or any other application that relies on picklescan for loading data.

The product affected is the Python library picklescan, developed by mmaitre314. All releases earlier than 0.0.30 are vulnerable; later versions have not been identified as containing the issue.

The CVSS score of 7.6 signals a high‑severity weakness. An EPSS score below 1 % indicates that automated exploitation is currently uncommon, and the vulnerability is not listed in CISA’s KE attacker would need to supply a dangerous pickle file to an application that uses picklescan to deserialize data – the attack vector is therefore malicious file to reach the target; executes with the privileges of the picking process.