The vulnerability in picklescan before version 0.0.30 involves a failure to detect malicious pickle files that exploit the make_label function in lib2to3.pgen2.pgen.ParserGenerator during the reduce method. This flaw enables attackers to embed malicious code within pickle files that bypass detection mechanisms but execute arbitrary commands upon deserialization with pickle.load(). The issue is identified as CWE-502, indicating a deserialization of untrusted data vulnerability. There is no information about available patches or fixes, and no known active exploitation has been reported.

Successful exploitation allows attackers to execute arbitrary commands on systems that deserialize malicious pickle files using vulnerable picklescan versions. This can lead to remote code execution and compromise of affected systems. The severity is high due to the potential for significant impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using picklescan versions prior to 0.0.30 for security-critical applications or environments where untrusted pickle data might be processed.