Ogrisel

**Name of the Vulnerable Software and Affected Versions** picklescan versions prior to 1.0.1 **Description** An unsafe deserialization issue allows unauthenticated users to execute arbitrary code on a host that loads a pickle payload from an untrusted source. This is achieved by hiding `eval` calls nested under callable objects using the `getattr` function. Attackers can embed malicious code within pickle files that evades detection by the software but executes upon loading, potentially facilitating supply chain attacks against systems loading serialized ML models, APIs, or saved Python objects. **Recommendations** Update to version 1.0.1 or later.