picklescan versions before 0.0.29 fail to detect malicious pickle payloads that exploit lib2to3.pgen2.grammar.Grammar.loads in the reduce method. This allows attackers to craft pickle files that evade detection and execute arbitrary code during deserialization with pickle.load(). The vulnerability is categorized as CWE-502 (Deserialization of Untrusted Data) and has a high severity rating.