picklescan before 0.0.29 contains an unsafe deserialization flaw (CWE-502) arising from the use of lib2to3.pgen2.grammar.Grammar.loads inside a reduce method. An attacker can craft a pickle file that embeds executable code that bypasses picklescan's detection logic, causing that code to run when the payload is deserialized with pickle.load(). This flaw enables arbitrary remote code execution on any system that processes the malicious pickle.

The vulnerability affects picklescan packages published by mmaitre314. All releases older than version 0.0.29 are vulnerable. Based on the description, it is inferred that releases 0.0.29 and newer have addressed the misuse of Grammar.loads, although this is not explicitly confirmed in the CVE record.

The CVSS score of 7.6 indicates a high severity, while the EPSS score of less than 1 % points to a low probability of exploitation in the current threat landscape. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an attacker to deliver a carefully crafted pickle file to an application that uses picklescan for validation and then performs pickle.load(), leading to remote code execution on the host system.