picklescan versions before 0.0.29 fail to detect malicious pickle files that exploit the idlelib.calltip.get_entity function in reduce methods. This allows attackers to embed code in pickle files that executes remote commands when loaded by victims. The vulnerability is classified under CWE-502 (Deserialization of Untrusted Data) and is considered high severity. No patch or official fix is currently documented. No known exploits in the wild have been reported.