The vulnerability in picklescan prior to version 0.0.33 involves a failure to detect malicious pickle files that use the numpy.f2py.crackfortran.param_eval function within reduce methods. This bypass of security checks enables remote attackers to craft pickle files containing undetected code that executes upon deserialization, resulting in arbitrary code execution. The issue is categorized under CWE-502 (Deserialization of Untrusted Data). No patch or remediation is currently documented, and no known exploits in the wild have been reported.

Successful exploitation allows remote attackers to execute arbitrary code on systems that deserialize untrusted pickle data using vulnerable picklescan versions. This can lead to full compromise of the affected application environment. The vulnerability is rated high severity due to the potential for remote code execution without requiring privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid deserializing pickle files from untrusted sources or implement additional validation controls to prevent loading malicious pickle data.