EUVD-2025-210301Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered malicious file, victim must run Picklescan and load it (UI:R); no auth needed (PR:N); RCE yields C:H/I:H but no inherent availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran._eval_length gadget in pickle __reduce__ methods, allowing arbitrary code execution. Attackers can craft malicious pickle files that execute arbitrary Python code when loaded by victims who trust Picklescan's safety validation.
Articles & Coverage 1
AnalysisAI
Arbitrary code execution in Picklescan before 0.0.33 occurs because the scanner fails to flag the numpy.f2py.crackfortran._eval_length gadget when used inside a pickle __reduce__ method, allowing crafted pickle files to be marked safe while still executing attacker-supplied Python on load. Workflows that rely on Picklescan to vet untrusted pickle or PyTorch model artifacts are exposed to supply-chain poisoning, and publicly available exploit code exists in the GHSA advisory.
Technical ContextAI
Picklescan is a Python library used to statically inspect pickle files for dangerous imports and callable references before pickle.load() is invoked, commonly applied to PyTorch model checkpoints distributed as untrusted artifacts. The root cause is CWE-502 (Deserialization of Untrusted Data) combined with an incomplete denylist: the scanner does not know that numpy.f2py.crackfortran._eval_length - a NumPy F2PY helper that internally evaluates a string expression - can be repurposed as a code-execution gadget when returned from __reduce__. Because pickle reconstruction invokes the returned callable with attacker-controlled arguments, the gadget effectively functions as an eval primitive, bypassing Picklescan's safety verdict. The affected CPE is cpe:2.3:a:picklescan:picklescan prior to 0.0.33.
RemediationAI
Vendor-released patch: upgrade Picklescan to 0.0.33 or later (pip install --upgrade picklescan>=0.0.33), which adds detection for the numpy.f2py.crackfortran._eval_length gadget per PR https://github.com/mmaitre314/picklescan/pull/53 and commit 70c1c6c31beb6baaf52c8db1b6c3c0e84a6f9dab. Until the upgrade is rolled out, do not rely on Picklescan's verdict as the sole gate for loading untrusted pickle or PyTorch model files: prefer safetensors or other non-executable serialization formats, sandbox pickle.load() in a disposable process or container with no network and no credentials, and pin model sources to trusted publishers with signature verification (trade-off: safetensors does not support arbitrary Python objects, and sandboxing adds latency and orchestration cost). Additionally, denylist numpy.f2py.crackfortran._eval_length in any internal pickle allowlist scanners as a stopgap, recognizing that other equivalent gadgets likely remain undiscovered.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today