picklescan versions before 0.0.30 fail to detect the use of asyncio.unix_events._UnixSubprocessTransport._start inside pickle reduce methods. An attacker can embed this built‑in function within a malicious pickle file that bypasses all internal checks and executes arbitrary commands when the file is deserialized, giving the attacker full code execution on the host. This is a classic deserialization of untrusted data weakness (CWE‑502) that can compromise confidentiality, integrity, and availability.

picklescan, developed by mmaitre314, version 0.0.29 and earlier are susceptible. Any deployment that processes pickle data from untrusted or external sources using these versions is at risk.

The vulnerability receives a CVSS score of 7.6, indicating high severity. The EPSS score of less than 1% shows that exploitation is currently unlikely, and the flaw is not listed in CISA’s KEV catalog. Exploitation requires an attacker to supply a crafted pickle file to the target application; when the file is processed, the hidden _start function triggers execution of arbitrary commands, effectively giving the attacker full control over the system.