EUVD-2025-210306
GHSA-x36p-c636-788x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered malicious pickle, no privileges, but victim must choose to load the file (UI:R); successful exploit yields full code execution, so C/I/A all High.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
picklescan before 0.0.33 fails to detect malicious pickle files that invoke numpy.f2py.crackfortran.myeval function through the reduce method. Attackers can craft malicious pickle files embedding arbitrary code that evades picklescan detection and executes remote code when loaded.
AnalysisAI
Detection bypass in picklescan before 0.0.33 allows attackers to smuggle arbitrary code through malicious pickle files by abusing numpy.f2py.crackfortran.myeval in a __reduce__ method, which the scanner fails to flag as dangerous. Any ML pipeline or model-hosting workflow that trusts picklescan's verdict before calling pickle.load() will execute attacker-controlled commands; publicly available exploit code exists in the GHSA advisory, and the CVSS 4.0 score of 7.6 reflects high confidentiality and integrity impact contingent on user interaction.
Technical ContextAI
picklescan is a Python security tool that statically inspects pickle byte streams for known-dangerous global imports and callables before deserialization, commonly used to gate PyTorch model loading. The vulnerability is a classic CWE-502 (Deserialization of Untrusted Data) blocklist gap: numpy.f2py.crackfortran.myeval - a helper inside NumPy's Fortran parser that calls Python's eval() on a supplied string - was not on picklescan's denylist of risky callables. When a pickle's __reduce__ returns (myeval, ('os.system(...)',)), the pickle machinery invokes myeval at load time, which evaluates the attacker-supplied string and yields arbitrary code execution under the victim process's identity.
RemediationAI
Vendor-released patch: picklescan 0.0.33 - upgrade via pip install --upgrade picklescan>=0.0.33, with the upstream fix in PR https://github.com/mmaitre314/picklescan/pull/53 and commit 70c1c6c31beb6baaf52c8db1b6c3c0e84a6f9dab. Until the upgrade lands, add numpy.f2py.crackfortran.myeval (and ideally the entire numpy.f2py.crackfortran module) to any local denylist or custom Unpickler.find_class() override, and treat any model whose scan predates the fix as untrusted; the trade-off is false positives against legitimate NumPy Fortran workflows, which are uncommon outside scientific computing. As a stronger compensating control, switch to safetensors or another non-pickle serialization for model interchange - this eliminates the deserialization class entirely but requires re-exporting existing checkpoints. Consult the GHSA advisory at https://github.com/mmaitre314/picklescan/security/advisories/GHSA-3329-ghmp-jmv5 for the authoritative fix details.
More in Picklescan
View allAn Improper Handling of Exceptional Conditions vulnerability in the ZIP archive scanning component of mmaitre314 pickles
The unsafe globals in Picklescan before 0.0.25 do not include ssl. Rated medium severity (CVSS 6.8), this vulnerability
picklescan before 0.0.21 does not treat 'pip' as an unsafe global. Rated medium severity (CVSS 5.3), this vulnerability
Remote code execution against users of picklescan versions prior to 1.0.4 is achievable by smuggling any blocked functio
Arbitrary code execution in picklescan versions prior to 1.0.1 allows attackers to bypass the scanner's malicious pickle
picklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. Rated m
Remote code execution in picklescan versions prior to 1.0.4 allows attackers to bypass the scanner's safety validation b
Arbitrary code execution bypass in picklescan before 1.0.4 allows attackers to smuggle malicious pickle files past the s
Detection bypass in picklescan versions prior to 0.0.27 allows attackers to smuggle malicious Python pickle files past t
Remote code execution in picklescan before 0.0.33 enables attackers to bypass the tool's malicious-pickle detection by s
Arbitrary file write in picklescan before 0.0.33 lets attackers bypass the tool's dangerous-call blocklist by abusing di
Arbitrary code execution in picklescan before 0.0.33 allows remote attackers to bypass the scanner's malicious-pickle de
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today