picklescan, when using a lib2to3 bundled version prior to 0.0.30, fails to recognize malicious pickle objects that exploit the ParserGenerator.make_label method inside reduce. An attacker can craft a pickle file that bypasses picklescan’s security checks, and when pickle.load() is invoked the embedded code is executed, granting the attacker arbitrary command execution on the host running the tool. This flaw falls under the category of deserialization of untrusted data (CWE-502).

All deployments of picklescan with a version earlier than 0.0.30 are affected. The vulnerability is inherent in the bundled lib2to3 library, so any environment that allows picklescan to deserialize untrusted pickle data—regardless of operating system or platform—is at risk. No narrower version scope is specified beyond the pre‑0.0.30 range, implying that all older releases are vulnerable.

The CVSS score of 7.6 signals a high severity of impact, while the EPSS score of less than 1% indicates that exploitation is currently considered unlikely. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that any process or user supplying a crafted pickle file to picklescan can trigger the vulnerability, meaning the attack vector includes local file ingestion and potentially remote injection if picklescan accepts data over a network. The vulnerability requires no authentication and can be triggered by simply calling pickle.load() on a malicious payload.