In short
- CVE-2025-71372 is a HIGH (CVSS 8.1) vulnerability affecting picklescan.
- Chance of exploitation in the next 30 days (EPSS): 0.48%, higher than 41.4% of all vulnerabilities.
- Fix: update to 0.0.33 or later.
| Package | Affected versions | Patched versions |
|---|
| picklescan PyPI | < 0.0.33
| 0.0.33
|
Description
Summary
Picklescan uses the numpy.f2py.crackfortran.getlincoef function (a NumPy F2PY helper) to execute arbitrary Python code during unpickling.
Details
Picklescan fails to detect a malicious pickle that uses the gadget numpy.f2py.crackfortran.getlincoef in __reduce__, allowing arbitrary command execution when the pickle is loaded. A crafted object returns this function plus attacker‑controlled arguments; the scan reports the file as safe, but pickle.load() triggers execution.
PoC
class PoC:
def __reduce__(self):
from numpy.f2py.crackfortran import getlincoef
return getlincoef, ("__import__('os').system('whoami')", None)
Impact
- Arbitrary code execution on the victim machine once they load the “scanned as safe” pickle / model file.
- Affects any workflow relying on Picklescan to vet untrusted pickle / PyTorch artifacts.
- Enables supply‑chain poisoning of shared model files.
Credits
NVD description
Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran.getlincoef gadget in pickle __reduce__ methods, allowing arbitrary code execution. Attackers can craft malicious pickle files that execute arbitrary Python code when loaded, bypassing Picklescan's safety checks and enabling supply-chain poisoning of shared model files.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free