picklescan fails to detect malicious pickle files that exploit torch._dynamo.guards.GuardBuilder.get in reduce methods. The flaw allows an attacker to embed arbitrary code within a pickle file that is executed when the file is loaded, giving complete control over the process running pick serialization vulnerability (CWE‑502) that can lead to full compromise of the host system.

The vulnerability exists in picklescan versions prior to 0.0.28. Any deployment that pickle data is impacted. The issue the code runs whenever picklescan is invoked.

The CVSS score of 7.6 indicates high severity, but the EPSS score of < 1% suggests a low probability of exploitation at present. The vulnerability is not listed in CISA KEV, no reports of widespread attacks. Likely exploitation would occur by delivering a crafted pickle file through file uploads, network services or scripts that invoke picklescan. If exploited, the attacker can execute arbitrary commands on the host machine.