The failure to detect unsafe deserialization in picklescan before version 0.0.33 allows an attacker to embed malicious Python code inside a pickle file. When picklescan processes the file, the NumPy f2py.crackfortran function unwittingly executes the embedded code with eval. This direct code injection is a CWE‑502 weakness that gives the attacker full control of the picklescan process.

The vulnerability affects the picklescan project maintained by mmaitre314. Any release with a version number lower than 0.0.33 is vulnerable; the advisories do not state that later releases are impacted.

The CVSS score of 7.6 classifies the issue as high severity, but the EPSS score of <1 % indicates a very low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a user or attacker supplying a crafted pickle file to a system running picklescan; when the file is loaded, arbitrary code executes with the privileges of the picklescan user. Because the vulnerability allows full code execution, any compromise has the potential to affect confidentiality, integrity, and availability of the target system.