The vulnerability in picklescan allows an attacker to inject a specially crafted pickle payload that bypasses the tool’s attempt to detect malicious code using the InteractiveInterpreter.runcode method during reduction processing. When a vulnerable application loads a pickle file with pickle.load(), the malicious code executes, giving the attacker arbitrary code execution on the host system. This reflects a classic deserialization flaw described by CWE-502, jeopardizing confidentiality, integrity, and availability of affected installations.

The affected product is picklescan developed by mmaitre314. Any instance of picklescan with a version earlier than 0.0.29 is susceptible. The vulnerability is present in the Python library that supplies the picklescan package and is commonly used by developers to scan or validate pickle objects.

The CVSS score of 7.6 indicates a high severity of exploitation. Because EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, the likelihood of a discovered exploit in the wild is uncertain, but the feasibility of exploitation is high for applications that allow external pickle input. If an attacker can supply a pickle file to a vulnerable system, they can achieve full code execution; the attack vector is therefore likely remote, via file upload or untrusted data ingestion, in applications that rely on picklescan without additional safeguards.