Which versions of Picklescan are affected by CVE-2025-71372?

Picklescan, a widely-used security scanner for machine-learning model files, is vulnerable to bypass attacks that allow malicious code to pass safety checks undetected; no public exploit identified…. A patch is available.

How to fix or mitigate CVE-2025-71372?

24 hours: Inventory all uses of Picklescan and document current versions across your ML infrastructure. 7 days: Implement secondary validation controls (e.g., sandboxing, code review, runtime monitoring) for all model deserialization activities; subscribe to Picklescan security advisories and GitHub repository for patch notification. 30 days: Upon vendor patch release, upgrade immediately; if no patch released by day 30, evaluate and pilot alternative model-validation frameworks.

Picklescan CVE-2025-71372

Q: What is the CVSS score of CVE-2025-71372?

CVE-2025-71372 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2025-210423 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-04 VulnCheck

GHSA-gf62-q6c8-6vxg

Deserialization Python RCE Picklescan

7.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

File is delivered over the network (AV:N) but a victim must load the scanner-cleared pickle (UI:R); no attacker auth (PR:N), and arbitrary Python code execution yields full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 04, 2026 - 03:01 EUVD

Analysis Generated

Jul 04, 2026 - 02:21 vuln.today

DescriptionCVE.org

Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran.getlincoef gadget in pickle __reduce__ methods, allowing arbitrary code execution. Attackers can craft malicious pickle files that execute arbitrary Python code when loaded, bypassing Picklescan's safety checks and enabling supply-chain poisoning of shared model files.

AnalysisAI

Security-scanner bypass in Picklescan before 0.0.33 lets attackers smuggle arbitrary-code-execution payloads past its safety checks by abusing the numpy.f2py.crackfortran.getlincoef gadget inside a pickle __reduce__ method, which the scanner fails to flag as dangerous. Because Picklescan is used to vet shared machine-learning model files, a malicious pickle passes as 'clean' and then executes attacker-controlled Python when the trusting downstream consumer deserializes it. No public exploit is identified at time of analysis, and it is not listed in CISA KEV; the CVSS 4.0 score is 7.6 and the attack depends on a victim actually loading the file.

Technical ContextAI

Picklescan is a Python tool that statically inspects pickle files for known dangerous opcodes and callable references before they are trusted and unpickled, and it is widely relied upon in the ML supply chain (including Hugging Face model scanning) to catch malicious serialized artifacts. The vulnerability is a CWE-502 (Deserialization of Untrusted Data) issue rooted not in a parser bug but in an incomplete denylist: Picklescan did not recognize numpy.f2py.crackfortran.getlincoef as a code-execution gadget reachable through a pickle __reduce__ method. Python's pickle format allows objects to specify a callable and arguments invoked at load time via __reduce__, and any importable function that ultimately evaluates or executes attacker-supplied data becomes an execution primitive; getlincoef in numpy's f2py crackfortran module is one such gadget that the scanner's allow/deny logic missed. The single affected component is cpe:2.3:a:picklescan:picklescan (all versions prior to 0.0.33).

RemediationAI

Vendor-released patch: upgrade Picklescan to version 0.0.33 or later, which adds detection for the numpy.f2py.crackfortran.getlincoef gadget; see advisory GHSA-rrxm-2pvv-m66x (https://github.com/mmaitre314/picklescan/security/advisories/GHSA-rrxm-2pvv-m66x). Because Picklescan is a denylist-based control that has now demonstrably missed at least one gadget, do not treat a passing scan as sufficient assurance for untrusted files: prefer loading models in non-executable serialization formats such as safetensors instead of pickle, which eliminates the __reduce__ execution primitive entirely (trade-off: requires converting or re-exporting existing pickle-format checkpoints). Where pickle must be used, restrict deserialization of externally-sourced model files to sandboxed or network-isolated environments with least-privilege service accounts so that code execution is contained (trade-off: added infrastructure and workflow friction), and only accept model files from trusted, integrity-verified sources.