picklescan before 0.0.30 fails to detect calls to the standard library's ensurepip._run_pip function when scanning pickle data, allowing an attacker to embed such calls in a malicious pickle's __reduce__ method. Loading the pickle file with pickle.load() will trigger the hidden function and execute arbitrary code in the process. The weakness is a classic deserialization flaw (CWE-502) that results in full code execution.

The vulnerability affects the picklescan utility provided by mmaitre314. Versions 0.0.26 and earlier are impacted; any deployment of these releases is susceptible to exploitation.

The assessed CVSS score of 7.6 indicates high potential impact. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, suggesting that public exploits may not yet exist but the risk remains significant. Based on the description, the likely attack vector is an attacker who can supply a crafted pickle file to a system that loads such data using picklescan; upon deserialization, the system will execute the injected code.