picklescan versions prior to 0.0.29 fail to strip out the built‑in trace.Trace.run command when analyzing pickle files, allowing an attacker to embed malicious code inside a pickle payload. When pickle.load processes such a file, the injected code is executed, resulting in control over the host system. This flaw is a classic deserialization vulnerability (CWE-502).

Users of picklescan:picklescan installation earlier than 0.0.29 are impacted; any environment that imports or loads untrusted pickle objects rendered by that version can be compromised.

The CVSS score of 7.6 indicates a moderate to high risk of exploitation, but the EPSS score is not available, limiting visibility into current attack likelihood. The vulnerability is not listed in the CISA KEV catalog, so no known large‑scale exploitation has been reported in the public feeds. The attack likely requires an attacker to supply a malicious pickle file to a system that processes it with picklescan; based on the description, the vector is remote or local depending on how the application accepts pickle data, so caution is advised for any service that ingests external pickles.