PickleScan v1.0.3 and earlier fail to block at least eight Python standard library functions that provide direct arbitrary command execution or code evaluation. Malicious pickle files importing these modules are reported as clean by PickleScan, enabling remote code execution that bypasses the scanner entirely. The affected modules include uuid._get_command_stdout, _osx_support._read_output, _osx_support._find_build_tool, _aix_support._read_cmd_output, _pyrepl.pager.pipe_pager, _pyrepl.pager.tempfile_pager, imaplib.IMAP4_stream, and test.support.script_helper.assert_python_ok. All these functions invoke subprocess or os.system calls. The vulnerability affects all PickleScan versions up to and including 1.0.3. The vendor suggests adding these modules to the unsafe globals blocklist and recommends switching to a default-deny allowlist approach for better security.

Any system using PickleScan for pickle safety validation is vulnerable to remote code execution via malicious pickle files that import the unblocked modules. This includes HuggingFace Hub, ML pipelines, and model registries relying on PickleScan. Attackers can upload malicious model files that pass all PickleScan checks and execute arbitrary code when loaded by users, leading to full system compromise. The CVSS score is 9.8 (critical), reflecting the high impact of direct RCE with no required privileges or user interaction.

A patch is available that updates PickleScan's unsafe globals blocklist to include the affected modules. Users should upgrade to a fixed version beyond 1.0.3 once released. The vendor also recommends architectural changes such as switching to a default-deny allowlist for permitted globals and treating all unknown globals as dangerous by default. Until patched, relying solely on PickleScan for pickle safety validation is unsafe.