picklescan versions prior to 0.0.28 contain a deserialization flaw: the tool does not detect malicious calls to torch.utils.bottleneck.__main__.run_cprofile that can be embedded inside pickle files. When a victim loads such a file the code is executed automatically, granting the attacker full control over the host and compromising confidentiality, integrity, and availability. This weakness is categorized as CWE‑502 – Serialization of untrusted data. The impact is that any user who deserializes a crafted pickle file in an environment where picklescan is installed can execute arbitrary code.

The vulnerability affects installations of picklescan from the picklescan GitHub project running any version earlier than 0.0.28. Recent releases may contain a fix, but verify that the unsafe deserialization logic has been removed; upgrading to the latest available version could eliminate the flaw if a remediation has been released.

The CVSS score of 7.6 indicates high severity, while the EPSS score of <1% suggests a very low probability of exploitation at this time. The flaw is remotely exploitable; an attacker only needs to distribute a malicious pickle file and convince a victim to load it. The vulnerability is not listed in CISA’s KEV catalog, and exploitation would require no specialized network access beyond the ability to deliver the forbidden file. With no network or privilege escalation prerequisites beyond deserialization, the attack vector is straightforward and relies solely on the presence of picklescan in the target environment.