The vulnerability in picklescan occurs before version 0.0.28, where the tool fails to detect malicious pickle files that embed code through the torch.utils.collect_env.run function. When victim users load these deceptive pickle files, the hidden code executes, allowing an attacker to run arbitrary commands on the host. This flaw constitutes a remote code execution weakness (CWE-502). The impact is the potential compromise of confidentiality, integrity, and availability of the affected system because the attacker can run any command.

The affected product is picklescan, authored by mmaitre314, in all releases earlier than 0.0.28. No specific sub‑versions are listed beyond the major threshold. Users deploying picklescan for handling pickle objects should review the component version.

The CVSS score of 7.6 marks this issue as High severity. The EPSS score is not available, so the current public exploit probability cannot be quantified, but the vulnerability’s presence in a package that commonly processes untrusted data elevates concern. The flaw is not listed in CISA’s KEV catalog, yet any functionality that evaluates arbitrary pickle data is inherently risky. Attackers could exploit the weakness by providing a crafted pickle that includes malicious code; upon deserialization by picklescan, the victim’s machine would execute it. Given that many systems allow pickle loading without isolation, the risk is real and actionable.