Picklescan, a tool for scanning Python pickle files for malicious content, fails to detect the built‑in _operator.methodcaller function when scanning pickle payloads in versions prior to 0.0.34. This oversight allows an attacker to craft a pickle that will pass the scanner yet be executed by pickle.load, resulting in arbitrary code execution with the privileges of the running process. The flaw is classified as CWE‑502 (Deserialization of Untrusted Data).

Affecting all picklescan releases earlier than 0.0.34, produced by mmaitre314. Systems that ingest, process, or validate arbitrary pickle data using these versions are directly vulnerable.

With a CVSS score of 7.6, the vulnerability carries high severity. The EPSS score of less than 1% indicates a very low probability of exploitation at present, and the flaw is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a malicious pickle file that bypasses the scanner, typically through file uploads, data ingestion pipelines, or APIs that accept arbitrary pickle data. Successful exploitation would grant the attacker full control over the host system.