picklescan versions prior to 0.0.28 fail to detect malicious calls to torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression embedded in pickle files. When such a pickle is loaded, the function is executed automatically, allowing an attacker to run arbitrary code on the host. This is a classic insecure deserialization flaw identified as CWE‑502, which can compromise confidentiality, integrity, and availability of the affected system.

The affected product is picklescan, developed by mmaitre314. Versions earlier than 0.0.28 lack the mitigation for evaluating guard expressions during deserialization and are therefore vulnerable when they process untrusted pickle files.

The CVSS score of 7.6 indicates a high severity vulnerability, while the EPSS score of < 1% suggests a very low probability of exploitation at the time in CISA’s KEV catalog. The likely attack vector is that an attacker supplies a crafted pickle file containing a malicious ShapeEnv.evaluate_guards_expression call; a victim process that deserializes the file with picklescan will execute the embedded code, leading to remote code execution.