picklescan - Arbitrary Code Execution via Obfuscated eval Call

An unauthenticated attacker crafts a malicious pickle file where the `__reduce__` method returns a tuple whose first element is a callable that internally uses `getattr(builtins, "eval")` to execute arbitrary code. When picklescan scans the file, it does not detect the obfuscated `eval` call, so the pickle passes validation. Any system that loads the pickle from an untrusted source (e.g., ML model repositories, APIs, or saved Python objects) will then execute the attacker's payload.

The vulnerability resides in picklescan's detection logic, which fails to flag `builtins.eval` calls when they are nested under another callable via `getattr`. The PoC in [ref_id=1] shows that wrapping `getattr(builtins, "eval")(payload)` inside a static method of a class evades the scanner's checks.

The advisory [ref_id=1] does not include a patch diff, but the fix (picklescan 1.0.1) must extend the scanner's AST or bytecode analysis to recursively inspect callables returned by `__reduce__` and detect `builtins.eval` even when accessed via `getattr`. Without this change, attackers can trivially bypass detection by hiding the dangerous function behind a layer of indirection.