Picklescan < 0.0.33 - CraftedSignal Threat Feed

CVE-2025-71373: Picklescan Bypass via `operator.methodcaller` Leads to Arbitrary Code Execution

hello@craftedsignal.io — Sat, 04 Jul 2026 02:29:27 +0000

CVE-2025-71373 details a critical vulnerability affecting picklescan versions before 0.0.33, a tool designed to validate the safety of Python pickle files. This flaw allows remote attackers to circumvent the security mechanisms by embedding operator.methodcaller function calls within crafted pickle files. picklescan fails to detect these specific calls, mistakenly deeming the malicious files as safe. Consequently, any system that processes these specially crafted pickle files and relies on the vulnerable picklescan for validation will execute the embedded arbitrary code upon loading the file, leading to full system compromise. This vulnerability carries a CVSS v3.1 base score of 8.1 (High), highlighting its severe impact and ease of exploitation.

Attack Chain

An attacker crafts a malicious Python pickle file containing arbitrary code embedded within operator.methodcaller function calls.
The attacker delivers this malicious pickle file to a target system, potentially via email, file upload functionality, or as part of a data exchange.
The target system, which is configured to process Python pickle files, receives the malicious payload.
The system invokes picklescan (version prior to 0.0.33) to validate the safety and integrity of the incoming pickle file.
During validation, picklescan fails to correctly identify and flag the operator.methodcaller function calls as malicious, allowing the bypass of its security checks.
The target application, erroneously assuming the pickle file is safe based on picklescan's flawed validation, proceeds to load the file into memory.
Upon loading, the arbitrary code embedded within the operator.methodcaller context is executed on the target system.
The attacker achieves arbitrary code execution, leading to system compromise, which can involve data exfiltration, further persistence, or other malicious actions.

Impact

Successful exploitation of CVE-2025-71373 grants remote attackers arbitrary code execution capabilities on affected systems. Organizations utilizing picklescan for validating pickle files, particularly in data processing pipelines or applications handling untrusted serialized Python objects, are at risk. This could lead to complete compromise of the affected servers or workstations, potentially resulting in data breaches, installation of malware, or disruption of critical services. The CVSS score of 8.1 reflects the high severity, indicating that an unauthenticated attacker can achieve high confidentiality and integrity impact with low attack complexity.

Recommendation

Immediately update picklescan to version 0.0.33 or later to patch CVE-2025-71373.
Ensure all applications handling Python pickle files validate their source and integrity rigorously, even when using security scanners.
Implement robust input validation and sanitization for all external inputs, especially those that might involve deserialization of data, to prevent malicious pickle files from being processed.

CVE-2025-71372: Picklescan Deserialization Vulnerability (Numpy Gadget)

hello@craftedsignal.io — Sat, 04 Jul 2026 02:28:44 +0000

CVE-2025-71372 addresses a significant security flaw in Picklescan versions before 0.0.33. Picklescan, a tool designed to analyze Python pickle files for malicious content, specifically fails to identify the numpy.f2py.crackfortran.getlincoef gadget when it's present within a pickle file's __reduce__ method. This oversight enables attackers to craft highly potent malicious pickle files that can contain and execute arbitrary Python code. When such a specially crafted pickle file is subsequently loaded by a Python application, the embedded code will execute, completely bypassing Picklescan's intended security defenses. This vulnerability poses a severe risk of supply-chain poisoning, particularly in environments where machine learning models or other data are exchanged as pickle files, as it allows attackers to inject malicious code into trusted data streams.

Attack Chain

Attacker Crafts Malicious Pickle File: An attacker creates a Python pickle file designed to exploit the vulnerability. This file specifically incorporates the numpy.f2py.crackfortran.getlincoef gadget within a __reduce__ method, embedding arbitrary Python code for execution.
Distribution of Malicious File: The malicious pickle file is distributed to target systems or users, often disguised as a legitimate shared resource, such as a machine learning model, dataset, or configuration file.
Picklescan Bypass: The victim organization uses Picklescan (version prior to 0.0.33) to scan the received pickle file for security threats. Due to the vulnerability, Picklescan fails to detect the embedded malicious gadget.
Legitimate Loading: A Python application within the victim's environment, believing the file to be safe due to the bypassed scan, loads (deserializes) the pickle file using standard Python pickle.load() functions.
Gadget Invocation: During the deserialization process, Python's pickle module encounters and invokes the __reduce__ method containing the malicious numpy.f2py.crackfortran.getlincoef gadget.
Arbitrary Code Execution: The arbitrary Python code embedded by the attacker within the gadget is executed on the system with the privileges of the Python application, leading to compromise, data exfiltration, or further system manipulation.
Supply Chain Poisoning: If the compromised system then shares derived or new model files, the malicious code could propagate, leading to wider supply-chain poisoning.

Impact

This vulnerability carries a high impact, allowing for arbitrary code execution and enabling supply-chain poisoning of shared model files. If successfully exploited, attackers can gain full control over the system where the malicious pickle file is loaded, leading to data theft, system disruption, or deployment of further malware. The nature of pickle files, often used in scientific computing and machine learning for sharing models and data, means that organizations relying on these exchanges could unknowingly ingest malicious code. The immediate consequence is a complete compromise of the processing environment, with potential follow-on effects of data loss, intellectual property theft, or widespread network intrusion.

Recommendation

Immediately update Picklescan to version 0.0.33 or newer to patch CVE-2025-71372 and ensure proper detection of malicious numpy gadgets.
Educate development and data science teams on the risks associated with deserializing untrusted pickle files, even those seemingly cleared by older versions of Picklescan.
Implement strict provenance checks for all pickle files entering the environment; only load files from trusted and verified sources.
Perform a retrospective scan of existing pickle files within your environment using the patched Picklescan version to identify any already compromised models or data artifacts.

CVE-2025-71347: Picklescan Bypass Leads to Arbitrary Code Execution via Malicious Pickle Files

hello@craftedsignal.io — Sat, 04 Jul 2026 02:21:21 +0000

A critical vulnerability, CVE-2025-71347, has been identified in the picklescan library prior to version 0.0.33. This flaw specifically impacts the library's ability to detect malicious pickle files that leverage the numpy.f2py.crackfortran.param_eval function within their reduce methods during deserialization. Remote attackers can exploit this bypass to embed arbitrary code within seemingly legitimate pickle files. When an application loads and deserializes such an untrusted, malicious pickle file, the embedded code executes, granting the attacker arbitrary code execution capabilities. This vulnerability is significant for organizations that process or scan Python pickle files, as it allows sophisticated bypasses of security tooling, potentially leading to system compromise through a trusted deserialization process. The issue stems from inadequate sanitization or detection logic within picklescan when encountering specific NumPy functions, highlighting the persistent risk of deserialization vulnerabilities in Python ecosystems.

Attack Chain

Payload Crafting: An attacker crafts a malicious Python pickle file, embedding a call to numpy.f2py.crackfortran.param_eval with attacker-controlled arguments within the pickle's reduce method.
Delivery: The attacker delivers the specially crafted malicious pickle file to a target system. This delivery can occur via various means such as email attachments, file downloads, or through compromised data repositories.
Defense Bypass: If the target system uses picklescan versions prior to 0.0.33 to inspect the file, the vulnerability (CVE-2025-71347) causes picklescan to fail to detect the malicious code embedded via numpy.f2py.crackfortran.param_eval.
Execution Trigger: A vulnerable application on the victim's system, designed to process Python pickle data, attempts to load and deserialize the untrusted, now undetected, malicious pickle file.
Arbitrary Code Execution: During the deserialization process, the embedded numpy.f2py.crackfortran.param_eval function is invoked by the Python interpreter, leading to the execution of arbitrary code defined by the attacker.
Impact: The attacker gains control over the application's process with the privileges of the running application, potentially allowing for data exfiltration, further system compromise, or persistence.

Impact

Successful exploitation of CVE-2025-71347 results in arbitrary code execution, enabling attackers to fully compromise the affected application and potentially the underlying system. This can lead to sensitive data exfiltration, installation of additional malware, privilege escalation, and complete control over the compromised environment. While the NVD advisory does not specify observed victims or targeted sectors, any organization that uses picklescan to validate Python pickle files or deserializes untrusted pickle data is at risk of severe impact, including financial loss, operational disruption, and reputational damage.

Recommendation

Upgrade picklescan to version 0.0.33 or later immediately to patch CVE-2025-71347.
Implement strict input validation and deserialization policies to prevent applications from loading untrusted pickle files, even if scanned by older picklescan versions.
Refer to the advisory links provided in the references section for more detailed information about CVE-2025-71347 and mitigation strategies.
Ensure all applications processing pickle data are isolated in sandboxed environments to minimize the blast radius of potential arbitrary code execution.