A flaw in Picklescan before version 0.0.25 allows an attacker to evade static checks and run dangerous code when a malicious pickle is deserialized. By embedding the function numpy.testing._private.utils.runstring in the reduce method, the attacker can import modules such as os and execute arbitrary operating‑system commands, leading to full compromise of the target system.

Picklescan, versions older than 0.0.25. This single product is affected; no other vendors or components are listed as vulnerable.

The CVSS score of 7.6 reflects a high severity level. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves presenting a crafted pickle file to an application that deserializes untrusted input; if the target system loads such a file it can be instructed to execute arbitrary code. Attackers could supply the file via file upload, malware delivery, or other external input channels. The combination of local code execution upon deserialization and the lack of mitigation EPSS suggests that the flaw remains a tangible threat for systems that use unsanitized pickle loading.