picklescan before 1.0.4 does not block at least seven Python standard library modules, exposing eight functions that allow arbitrary command execution; attackers can craft malicious pickle files that import these unblocked modules, achieving remote code execution while bypassing picklescan's safety validation entirely. This flaw is classified as CWE-184, representing an unrestricted reading of data that leads to code injection.

The vulnerability affects picklescan by picklescan, specifically all versions older than 1.0.4. Systems running these earlier releases are exposed to user-supplied pickle deserialization that can execute arbitrary code.

The CVSS score is 9.3, indicating critical severity; EPSS information is currently unavailable, so the exact exploit likelihood is uncertain, and the vulnerability is not listed in the CISA KEV catalog. The attack vector involves sending crafted pickle payloads that import unblocked standard library modules, enabling remote code execution without triggering any safety checks. Because picklescan performs no additional validation, any process that calls picklescan with untrusted data is a potential entry point for exploitation.