Picklescan
CVE-2025-71339
HIGH
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered malicious file, victim must run Picklescan and load it (UI:R); no auth needed (PR:N); RCE yields C:H/I:H but no inherent availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran._eval_length gadget in pickle __reduce__ methods, allowing arbitrary code execution. Attackers can craft malicious pickle files that execute arbitrary Python code when loaded by victims who trust Picklescan's safety validation.
AnalysisAI
Arbitrary code execution in Picklescan before 0.0.33 occurs because the scanner fails to flag the numpy.f2py.crackfortran._eval_length gadget when used inside a pickle __reduce__ method, allowing crafted pickle files to be marked safe while still executing attacker-supplied Python on load. Workflows that rely on Picklescan to vet untrusted pickle or PyTorch model artifacts are exposed to supply-chain poisoning, and publicly available exploit code exists in the GHSA advisory.
Technical ContextAI
Picklescan is a Python library used to statically inspect pickle files for dangerous imports and callable references before pickle.load() is invoked, commonly applied to PyTorch model checkpoints distributed as untrusted artifacts. The root cause is CWE-502 (Deserialization of Untrusted Data) combined with an incomplete denylist: the scanner does not know that numpy.f2py.crackfortran._eval_length - a NumPy F2PY helper that internally evaluates a string expression - can be repurposed as a code-execution gadget when returned from __reduce__. Because pickle reconstruction invokes the returned callable with attacker-controlled arguments, the gadget effectively functions as an eval primitive, bypassing Picklescan's safety verdict. The affected CPE is cpe:2.3:a:picklescan:picklescan prior to 0.0.33.
RemediationAI
Vendor-released patch: upgrade Picklescan to 0.0.33 or later (pip install --upgrade picklescan>=0.0.33), which adds detection for the numpy.f2py.crackfortran._eval_length gadget per PR https://github.com/mmaitre314/picklescan/pull/53 and commit 70c1c6c31beb6baaf52c8db1b6c3c0e84a6f9dab. Until the upgrade is rolled out, do not rely on Picklescan's verdict as the sole gate for loading untrusted pickle or PyTorch model files: prefer safetensors or other non-executable serialization formats, sandbox pickle.load() in a disposable process or container with no network and no credentials, and pin model sources to trusted publishers with signature verification (trade-off: safetensors does not support arbitrary Python objects, and sandboxing adds latency and orchestration cost). Additionally, denylist numpy.f2py.crackfortran._eval_length in any internal pickle allowlist scanners as a stopgap, recognizing that other equivalent gadgets likely remain undiscovered.
More from same product – last 7 days
Authentication bypass in StarTree mcp-pinot versions 3.0.1 and earlier exposes the Model Context Protocol HTTP server on
Unauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.9.3 allows attackers to fully comprom
Cross-user flow execution in Langflow versions prior to 1.9.1 allows any authenticated API user to run another user's fl
Unauthenticated remote code execution in Crawl4AI versions <= 0.8.6 allows attackers to escape the AST-based sandbox in
InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a co
Share
External POC / Exploit Code
Leaving vuln.today