0.0.30 accepts pickle files that can invoke the function torch.utils.bottleneck.__main__.run. This oversight creates a binary deserialization flaw (CWE-502) that allows an attacker to embed code that is automatically executed when the pickle is processed, resulting in remote code execution.

All supported releases of picklescan older than version 0.0.30 are affected. The vulnerable code path exists in30 build of the picklescan tool.

The CVSS score of 7.6 reflects a high severity impact. The EPSS score of <1 % points to a low, but nonzero, probability of exploitation; the vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is an attacker who can supply or influence the pickle file that picklescan deserializes, for example via a file upload interface or a network file transfer. Once the file is processed, the malicious code runs with the privileges of the picklescan process.