picklescan versions prior to 0.0.30 fail to detect calls to asyncio.unix_events._UnixSubprocessTransport._start in pickle reduce methods. An attacker can embed this built‑in function in a malicious pickle file that bypasses all internal checks and executes arbitrary commands when the file is deserialized, giving the attacker full code execution on the host. This is a classic deserialization of untrusted data weakness (CWE‑502) that can compromise confidentiality, integrity, and availability.

picklescan (developed by mmaitre314) prior to 0.0.30 is vulnerable. Any deployment that loads pickle data from untrusted or external sources using picklescan before this version is at risk.

The vulnerability carries a CVSS score of 7.6, indicating high severity. The EPSS score of less than 1% shows a low likelihood of exploitation currently, and the flaw is not listed in CISA’s KEV catalog. Exploitation requires an attacker to supply a crafted pickle file to the target application; when the file is processed, the hidden _start function triggers the execution of arbitrary commands, effectively giving the attacker full control over the system.