picklescan before version 0.0.29 fails to detect malicious pickle files that employ idlelib.autocomplete.AutoComplete.fetch_completions within reduce methods, allowing attackers to embed and execute arbitrary code when those pickle files are loaded. The vulnerability is a classic instance of insecure deserialization (CWE-502) where untrusted data can cause unintended code execution.

The affected product is picklescan from the mmaitre314 project; any installation using a version earlier than 0.0.29 is susceptible. The vulnerability applies to all operating systems where picklescan is run, as the issue resides in the Python package logic and not OS‑specific code.

The CVSS score of 7.6 indicates a high‑severity flaw, but the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. Attackers must supply a malicious pickle file that the victim processes, so the release stage is likely local or controlled by the user who runs picklescan. Once executed, the payload can perform arbitrary system commands, leading to full compromise of the host and any data accessed by picklescan. The absence of an EPSS score suggests limited public exploitation data, but the high CVSS and the potential for complete code execution make it a critical risk for any environment that uses picklescan to load user-provided pickles.