Picklescan prior to version 0.0.25 does not detect malicious pickle files that utilize the timeit.timeit() function within the __reduce__ method. This evasion enables remote code execution by allowing crafted pickle files to import and execute commands from dangerous libraries like os when deserialized. The vulnerability is tracked under CWE-184 and has a CVSS 4.0 vector indicating network attack vector, low attack complexity, partial attack prerequisites, partial user interaction, and high impact on confidentiality and integrity. The advisory is a duplicate and has been withdrawn, with the original advisory GHSA-v7x6-rv5q-mhwc providing the authoritative details.

Successful exploitation allows remote attackers to execute arbitrary system commands on the target system by deserializing malicious pickle files that evade detection. This leads to potential full compromise of confidentiality and integrity of the affected system. No known exploits are reported in the wild at this time.

A patch is available for picklescan to address this vulnerability. Users should upgrade to version 0.0.25 or later to mitigate the risk. Since this advisory is a duplicate and withdrawn, users should refer to the original advisory GHSA-v7x6-rv5q-mhwc for detailed remediation instructions.