picklescan before 0.0.29 does not detect malicious pickle files that exploit idlelib.autocomplete.AutoComplete.get_entity in reduce methods. An attacker can embed code that runs arbitrary commands when the file is loaded by pickle.load, giving the attacker full control of the system and compromising confidentiality, integrity, and availability.

The vulnerability affects picklescan versions prior to 0.0.29, produced by mmaitre314. Users running any pre‑0.0.29 release are susceptible; newer releases contain the fix.

The CVSS score is 7.6 and no EPSS data is available. The vulnerability is not listed in CISA KEV. Because it is triggered when a user loads a crafted pickle file, the attack vector is local/file‑based; the attacker must supply a malicious file to a victim who uses pickle.load. The impact is significant, but exploitation requires user interaction and is not remotely server‑side.