PickleScan versions before 1.0.4 do not block certain Python standard library modules that allow direct arbitrary command execution. This flaw enables attackers to craft malicious pickle files that import these unblocked modules, bypassing PickleScan's safety validation and leading to remote code execution. The advisory has been withdrawn as a duplicate of GHSA-g38g-8gr9-h9xp but remains for reference.