Picklescan, prior to version 0.0.34, does not detect _operator.attrgetter function calls embedded in pickle payloads. This oversight allows an attacker to craft a malicious pickle file that invokes _operator.attrgetter within reduce methods. When pickle.load() processes such a payload, arbitrary code is executed on the host machine. The vulnerability is therefore a remote code execution flaw rooted in improper validation of deserialized objects (CWE-502).

The picklescan project’s tool is vulnerable in all releases before 0.0.34. Applications that incorporate picklescan for deserialization and rely on pickle.load() are exposed unless they upgrade to a version that includes the fix.

The CVSS score of 7.6 signals a high severity condition. The EPSS score of <1% indicates exploitation is unlikely but still possible. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker requires remote access to supply a crafted pickle file to any application that uses picklescan for deserialization. Successful exploitation would give the attacker full control over the system that loads the file.