Which versions of picklescan are affected by CVE-2025-71362?

Picklescan, the primary security tool for validating untrusted Python serialized objects, contains a detection bypass allowing attackers to smuggle arbitrary code past the scanner and into files…. A patch is available.

How to fix or mitigate CVE-2025-71362?

Within 24 hours: Inventory all production systems using picklescan and identify where untrusted pickle/model files are deserialized. Within 7 days: Implement compensating controls-disable pickle deserialization for untrusted sources where possible, apply application-level sandboxing, and segment networks to limit blast radius. Within 30 days: Subscribe to picklescan release notifications; upgrade to version 0.0.33 or later immediately upon availability.

picklescan CVE-2025-71362

Q: What is the CVSS score of CVE-2025-71362?

CVE-2025-71362 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2025-210418 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-04 VulnCheck

GHSA-r9x2-mw85-9c4x

Deserialization Picklescan

7.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Untrusted file delivered over the network (AV:N) but success needs a specific crackfortran gadget plus numpy present (AC:H) and the victim must load the file (UI:R); arbitrary code execution yields full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 04, 2026 - 03:01 EUVD

Analysis Generated

Jul 04, 2026 - 02:13 vuln.today

DescriptionCVE.org

picklescan before 0.0.33 fails to detect unsafe deserialization when numpy.f2py.crackfortran functions call eval on arbitrary strings. Attackers can embed malicious code in pickle files that executes when loaded from untrusted sources.

AnalysisAI

Malicious-pickle detection bypass in picklescan before 0.0.33 lets attackers smuggle arbitrary code past the scanner by abusing numpy.f2py.crackfortran functions that call eval() on attacker-controlled strings. Because picklescan is itself the security tool meant to vet untrusted pickle/model files, this evasion causes a weaponized pickle to be marked safe, so the embedded code executes when the file is later deserialized. Reported by VulnCheck with a CVSS 4.0 score of 7.6; no public exploit identified at time of analysis and it is not in CISA KEV.

Technical ContextAI

picklescan is a Python utility that statically inspects pickle opcode streams for dangerous global imports/callables before an object or model is unpickled, and is widely used to guard ML supply chains (e.g. models pulled from public hubs). The root cause is CWE-502 (Deserialization of Untrusted Data) manifesting as an incomplete detection blocklist: picklescan did not classify numpy.f2py.crackfortran helper functions as dangerous, yet several of those functions internally call eval() on string arguments. An attacker can craft a pickle whose GLOBAL/REDUCE opcodes invoke a crackfortran function with a malicious expression, which the scanner deems benign but which evaluates arbitrary Python at load time. The affected component per CPE is cpe:2.3:a:picklescan:picklescan up to 0.0.32, fixed in 0.0.33; exploitation additionally depends on numpy being importable in the victim environment.

RemediationAI

Upgrade picklescan to the fixed release - Vendor-released patch: 0.0.33 - via pip (pip install --upgrade 'picklescan>=0.0.33') and rebuild any container images or CI pipelines that pin an older version, per GHSA-r8g5-cgf2-4m4m. Until upgraded, do not treat a picklescan pass as proof of safety for untrusted pickles: prefer safer serialization such as safetensors for model weights, and load untrusted pickles only in a sandboxed, network-isolated, least-privilege environment so the eval payload cannot cause real damage, at the cost of added operational overhead. As an additional compensating control, explicitly add numpy.f2py.crackfortran (and the broader numpy.f2py namespace) to any custom deserialization deny logic to block this specific gadget, accepting that such a hand-maintained list may still miss other eval sinks.