picklescan before version 0.0.28 does not detect malicious pickle files that embed torch.utils.data.datapipes.utils.decoder.basichandlers in their reduce methods, enabling unsafe deserialization that triggers arbitrary code execution during load. The flaw, classified as CWE‑502, allows an attacker to embed executable code into a pickle file that will run inside the picklescan process as soon as the file is deserialized, compromising confidentiality, integrity, and availability of the host system as the tool executes with whatever privileges it possesses.

The vulnerability impacts the picklescan utility from mmaitre314. Any installation using a picklescan version earlier than 0.0.28 is exposed; the issue is resolved in version 0.0.28 and later.

The CVSS score of 7.6 indicates a high severity assessment, while an EPSS score of less than 1 % suggests exploitation is currently considered unlikely on a large scale. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the most likely attack vector involves an attacker crafting a pickle file that includes basichandlers in its reduce methods, then submitting that file to picklescan for analysis. If processed, the embedded code will execute during deserialization, granting the attacker remote execution capabilities, which can be especially dangerous if picklescan runs with elevated privileges or processes untrusted files.