The vulnerability stems from picklescan not detecting malicious idlelib.calltip.Calltip.fetch_tip calls embedded inside Python pickle files. This oversight allows an attacker to craft a pickle file containing undetected payloads that execute arbitrary code when the file is loaded with pickle.load(). The flaw is a classic code injection weakness classified as CWE‑95, which permits attackers to compromise the confidentiality, integrity, and availability of the affected system if the pickle file is processed.

The product in question is picklescan by mmaitre314. All versions prior to 0.0.29 are affected, as this is the last release that introduced detection of the offending call. Users running any older instance should consider their environment as compromised until a patch or mitigation is applied.

The CVSS score of 7.6 indicates a high risk of exploiting this flaw. Although the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, the nature of the flaw still allows remote code execution when an attacker can force the application to load a malicious pickle file. The likely attack vector is the ingestion of an untrusted pickle file by the application, which then deserializes it with pickle.load(), triggering the malicious code. Due to the lack of detection, no additional authentication or privilege checks are performed, making exploitation straightforward if the attacker has a path to supply the pickle file.