Picklescan prior to version 0.0.33 does not detect the numpy.f2py.crackfortran.getlincoef __reduce__ method in pickle objects, enabling attackers to embed and execute arbitrary Python code during deserialization. The vulnerability is a classic instance of data deserialization without validation (CWE-502) and permits code execution when a malicious pickle file is processed, compromising confidentiality, integrity, and availability.

The affected product is Picklescan, developed by mmaitre314. All releases before 0.0.33 contain the flaw and are vulnerable. Users employing these versions are at risk if untrusted pickle files are loaded, particularly in shared model scenarios.

The CVSS score of 7.6 classifies this vulnerability as high severity. Exploitation requires a victim to ingest a malicious pickle file, which can occur through file ingestion or network delivery of an untrusted model artifact. The EPSS score of < 1% indicates a very low but non-zero probability of exploitation, and the vulnerability is not listed in CISA KEV. Despite the low exploitation likelihood, the high severity and potential for supply‑chain compromise make it a significant risk.