The vulnerability in picklescan occurs because the program fails to block calls to pkgutil.resolve_name in versions prior to 1.0.4. This omission allows an attacker to resolve dangerous built‑in functions such as os.system, builtins.exec, or subprocess.call through indirect REDUCE calls, thereby bypassing the entire blocklist. Executing any of these functions grants the attacker full remote code execution capabilities on the host running picklescan.

Any installation of the picklescan library released by mmaitre314 that is earlier than version 1.0.4 is affected. This includes v1.0.3 and all prior releases of the package.

The CVSS score of 10 classifies the flaw as critical. The EPSS score of <1 % suggests low exploitation probability at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker would need to supply malicious input to picklescan’s processing functions, which then use pkgutil.resolve_name to resolve dangerous built‑in functions such as os.system or builtins.exec. The likely attack vector is through untrusted user input analyzed by picklescan. The risk is high for deployments that expose picklescan to external users or allow untrusted code, as execution of the resolved functions grants remote code execution.