CVE-2025-71372

HIGH

Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.getlincoef

Published December 30, 2025Updated July 8, 2026Source: osv

Summary

### Summary Picklescan uses the `numpy.f2py.crackfortran.getlincoef` function (a NumPy F2PY helper) to execute arbitrary Python code during unpickling. ### Details Picklescan fails to detect a malicious pickle that uses the gadget `numpy.f2py.crackfortran.getlincoef` in `__reduce__`, allowing arbitrary command execution when the pickle is loaded. A crafted object returns this function plus attacker‑controlled arguments; the scan reports the file as safe, but pickle.load() triggers execution. ### PoC ```python class PoC: def __reduce__(self): from numpy.f2py.crackfortran import getlincoef return getlincoef, ("__import__('os').system('whoami')", None) ``` ### Impact - Arbitrary code execution on the victim machine once they load the “scanned as safe” pickle / model file. - Affects any workflow relying on Picklescan to vet untrusted pickle / PyTorch artifacts. - Enables supply‑chain poisoning of shared model files. ### Credits - [ac0d3r](https://github.com/ac0d3r) - [Tong Liu](https://lyutoon.github.io), Institute of information engineering, CAS

Remediation

Upgrade to the fixed version using your package manager.

pip

Update picklescan to 0.0.33 or later

pip install "picklescan>=0.0.33"

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Package	Ecosystem	Affected	Fixed In
picklescan	pypi	0.0.1, 0.0.10, 0.0.11, 0.0.12 (+28 more)	0.0.33

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-502
Deserialization of Untrusted DataMITRE
CWE-94
Code InjectionMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.3 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

—

Confidentiality

—

Integrity

—

Availability

—

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

References

Frequently Asked Questions

What is CVE-2025-71372?: Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.getlincoef This vulnerability has been assigned a severity rating of HIGH (CVSS score: 9.3/10).
How do I check if my project is affected by CVE-2025-71372?: CVE-2025-71372 affects picklescan. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-71372 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.3

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-rrxm-2pvv-m66x

Related CVEs

CVE-2026-53873
CRITICAL
PickleScan's profile.run blocklist mismatch allows exec() bypass
CVE-2026-56315
CRITICAL
PickleScan has multiple stdlib modules with direct RCE not in blocklist
CVE-2025-71367
HIGH
Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.attrgetter
CVE-2025-71320
HIGH
Picklescan has Incomplete List of Disallowed Inputs
CVE-2025-71375
HIGH
Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.methodcaller
CVE-2025-71325
HIGH
Picklescan has pickle parsing logic flaw that leads to malicious pickle file bypass
CVE-2026-53874
HIGH
picklescan missing detection by simple obfuscation of a `builtins.eval` call
CVE-2025-71321
HIGH
Picklescan vulnerable to Arbitrary File Writing

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies