picklescan before 0.0.29 contains an unsafe deserialization flaw (CWE-502) that arises from passing a malicious pickle payload through lib2to3.pgen2.grammar.Grammar.loads inside a reduce method. An attacker can embed executable code within a crafted pickle file that bypasses picklescan’s detection logic, causing that code to run when pickle.load() performs deserialization. The result is arbitrary code execution on any host that processes the malicious pickle payload.

The vulnerability affects picklescan packages published by mmaitre314. The CVE description indicates that all releases prior to 0.0.29 are vulnerable, while no version boundary is explicitly listed otherwise. Exact affected versions beyond this boundary are not detailed in the available data.

The CVSS score of 7.6 signals high severity, whereas the EPSS score of < 1 % indicates a low current likelihood of exploitation. The vulnerability is not in CISA’s KEV catalog. An attacker must deliver a carefully crafted pickle file to an application that uses picklescan for validation and then performs pickle.load(); when this occurs, the embedded code executes, compromising the host system.