picklescan for Python loads serialized data using pickle.load and internally processes payloads with idlelib.run.Executive.runcode during reduce methods. The vulnerability allows an attacker to embed malicious code that is executed automatically when an unserialized pickle file is loaded, enabling arbitrary code execution in the context of the application. This flaw, classified as CWE‑502 (Deserialization of Untrusted Data), can be used to compromise systems that load PyTorch models or other data via picklescan, and can be exploited in supply chain attacks.

The software affected is the Python package picklescan developed by mmaitre314. All releases prior to version 0.0.30 contain the issue; later releases do not have the defect.

The CVSS score of 7.6 indicates a high‑severity vulnerability, and the EPSS score below 1 % suggests that automated exploitation is currently uncommon. The vulnerability is not listed in CISA’s KEV catalog. An attacker would need to provide a crafted malicious pickle file to an application that uses picklescan for deserialization; the code executes with the privileges of the running process, making the attack vector a malicious file delivered to the target.