picklescan, prior to version 0.0.30, bundled lib2to3.pgen2.pgen.ParserGenerator.make_label function used inside the reduce method. An attacker can craft a malicious pickle file that bypasses picklescan’s detection logic, causing the original picklescan process to deserialize malicious payloads. This grants execution and full control over the system running picklescan. The weakness is classified as CWE‑502.

All deployments of the open‑source tool picklescan running a version earlier than 0.0.30 are affected. The vulnerability exists in the bundled lib2to3 library, so any environment that processes untrusted pickle data with picklescan—regardless of operating system or platform—is impacted. No explicit list of vulnerable versions beyond the pre‑0.0.30 range is provided, so the assumption is that every earlier release is vulnerable.

The CVSS score of 7.6 indicates a high severity impact, while the EPSS score of less than 1% suggests that exploitation is currently considered unlikely. The vulnerability is not catalogued in the CISA KEV list. The attack does not require authentication; any user or process that supplies a crafted pickle file can trigger the flaw. The likely attack vector is local when picklescan reads a file from the filesystem or accepts pickle data over a network or from external sources.