Picklescan - CraftedSignal Threat Feed

CVE-2025-71375: Picklescan Arbitrary Code Execution via _operator.methodcaller Evasion

hello@craftedsignal.io — Sat, 04 Jul 2026 02:30:22 +0000

A critical vulnerability, tracked as CVE-2025-71375, has been identified in the picklescan Python library, affecting all versions before 0.0.34. This flaw allows malicious actors to bypass security checks designed to detect harmful code within Python pickle files. Specifically, picklescan fails to recognize the _operator.methodcaller built-in function as a potential threat vector. Attackers can leverage this oversight to embed arbitrary code within a pickle payload. When such a specially crafted payload is subsequently loaded by an application using Python's standard pickle.load() function, the embedded malicious code will execute, leading to potential system compromise. This vulnerability is significant for organizations that process or share Python pickle files and rely on picklescan for their security posture.

Attack Chain

Attacker crafts a malicious Python pickle payload, meticulously designed to leverage the _operator.methodcaller built-in function to embed arbitrary code.
The malicious pickle payload is delivered to a target system, potentially as part of an uploaded file, a network stream, or a malicious data artifact exchanged between services.
A system or application utilizing the picklescan library (version prior to 0.0.34) attempts to scan the received pickle file for malicious content to ensure its safety before processing.
Due to the vulnerability (CVE-2025-71375), picklescan fails to identify the _operator.methodcaller based malicious code within the pickle payload, allowing it to be marked as "safe" or undetected.
The legitimate application or service then proceeds to load the unsanitized (and still malicious) pickle file into memory using Python's pickle.load() function.
Upon deserialization, the _operator.methodcaller embedded in the pickle payload triggers the execution of the attacker's arbitrary code within the context and privileges of the vulnerable application.
The attacker achieves arbitrary code execution, which can lead to data exfiltration, system compromise, establishment of persistence, or further network pivoting within the victim's environment.

Impact

The successful exploitation of CVE-2025-71375 grants attackers arbitrary code execution capabilities on the affected system. This can lead to severe consequences, including full system compromise, sensitive data exfiltration, denial of service, or the deployment of further malware such as ransomware. While no specific victim count or targeted sectors are mentioned, any organization or developer using picklescan before version 0.0.34 to sanitize Python pickle files is at risk. The CVSS v3.1 base score of 8.1 (High) underscores the critical nature of this vulnerability, highlighting that it can be exploited remotely without authentication, requiring only user interaction (e.g., loading the malicious pickle).

Recommendation

Patch CVE-2025-71375 immediately by upgrading the picklescan library to version 0.0.34 or higher in all development, staging, and production environments.
Implement strong input validation and deserialization policies, assuming any untrusted pickle file, even those scanned by vulnerable versions of picklescan, may contain malicious code.
Review existing codebases for instances of pickle.load() being used on data from untrusted sources, even if processed by picklescan.

CVE-2025-71373: Picklescan Bypass via `operator.methodcaller` Leads to Arbitrary Code Execution

hello@craftedsignal.io — Sat, 04 Jul 2026 02:29:27 +0000

CVE-2025-71373 details a critical vulnerability affecting picklescan versions before 0.0.33, a tool designed to validate the safety of Python pickle files. This flaw allows remote attackers to circumvent the security mechanisms by embedding operator.methodcaller function calls within crafted pickle files. picklescan fails to detect these specific calls, mistakenly deeming the malicious files as safe. Consequently, any system that processes these specially crafted pickle files and relies on the vulnerable picklescan for validation will execute the embedded arbitrary code upon loading the file, leading to full system compromise. This vulnerability carries a CVSS v3.1 base score of 8.1 (High), highlighting its severe impact and ease of exploitation.

Attack Chain

An attacker crafts a malicious Python pickle file containing arbitrary code embedded within operator.methodcaller function calls.
The attacker delivers this malicious pickle file to a target system, potentially via email, file upload functionality, or as part of a data exchange.
The target system, which is configured to process Python pickle files, receives the malicious payload.
The system invokes picklescan (version prior to 0.0.33) to validate the safety and integrity of the incoming pickle file.
During validation, picklescan fails to correctly identify and flag the operator.methodcaller function calls as malicious, allowing the bypass of its security checks.
The target application, erroneously assuming the pickle file is safe based on picklescan's flawed validation, proceeds to load the file into memory.
Upon loading, the arbitrary code embedded within the operator.methodcaller context is executed on the target system.
The attacker achieves arbitrary code execution, leading to system compromise, which can involve data exfiltration, further persistence, or other malicious actions.

Impact

Successful exploitation of CVE-2025-71373 grants remote attackers arbitrary code execution capabilities on affected systems. Organizations utilizing picklescan for validating pickle files, particularly in data processing pipelines or applications handling untrusted serialized Python objects, are at risk. This could lead to complete compromise of the affected servers or workstations, potentially resulting in data breaches, installation of malware, or disruption of critical services. The CVSS score of 8.1 reflects the high severity, indicating that an unauthenticated attacker can achieve high confidentiality and integrity impact with low attack complexity.

Recommendation

Immediately update picklescan to version 0.0.33 or later to patch CVE-2025-71373.
Ensure all applications handling Python pickle files validate their source and integrity rigorously, even when using security scanners.
Implement robust input validation and sanitization for all external inputs, especially those that might involve deserialization of data, to prevent malicious pickle files from being processed.

CVE-2025-71366: Picklescan Deserialization Vulnerability Leads to RCE

hello@craftedsignal.io — Sat, 04 Jul 2026 02:26:41 +0000

A significant deserialization vulnerability, tracked as CVE-2025-71366, has been identified in picklescan versions predating 0.0.28. This flaw allows malicious actors to craft Python pickle files that include specific torch.utils.bottleneck.__main__.run_cprofile function calls. Critically, the picklescan library, designed to detect and prevent malicious code execution from untrusted pickle files, fails to properly identify these embedded calls. This bypass of security checks enables remote attackers to inject and execute arbitrary code. When a victim's system loads such a specially crafted and undetected malicious pickle file, the embedded code executes with the privileges of the application processing the file, leading to potential system compromise and data loss. This vulnerability is highly impactful due to the widespread use of pickle files in Python ecosystems for data serialization and the security trust placed in picklescan.

Attack Chain

An attacker crafts a malicious Python pickle file containing a serialized object that leverages torch.utils.bottleneck.__main__.run_cprofile to embed arbitrary code.
The attacker ensures the payload is specifically designed to bypass the detection mechanisms implemented in picklescan versions older than 0.0.28.
The attacker delivers the crafted malicious pickle file to a target system, potentially through untrusted data ingestion, shared repositories, or direct download.
A user or an automated process on the victim's system initiates the loading of the malicious pickle file using a Python application that integrates with the vulnerable picklescan library.
During the scanning process, the vulnerable picklescan library (version < 0.0.28) fails to detect the malicious torch.utils.bottleneck.__main__.run_cprofile call due to the inherent deserialization vulnerability.
Upon deserialization of the undetected malicious pickle file, the embedded arbitrary code is executed on the victim's system, achieving remote code execution.

Impact

Successful exploitation of CVE-2025-71366 results in arbitrary code execution on the victim's system, allowing attackers to take full control of the compromised machine. This can lead to unauthorized data access, modification, or exfiltration; installation of malware such as ransomware or backdoors; and further lateral movement within the network. While specific victim counts or targeted sectors are not provided in the source, any organization or individual processing untrusted pickle files with vulnerable versions of picklescan could be at risk, especially those in data science, machine learning, or research environments.

Recommendation

Patch CVE-2025-71366 immediately by upgrading picklescan to version 0.0.28 or later to address the deserialization vulnerability.
Implement strict validation and sandboxing for all incoming pickle files, especially those from untrusted sources, even after patching, as a defense-in-depth measure against similar deserialization flaws.

CVE-2025-71362 — picklescan before 0.0.33 fails to detect unsafe deserialization when numpy.f2py.crackfortran functio...

hello@craftedsignal.io — Sat, 04 Jul 2026 02:25:03 +0000

A critical vulnerability, CVE-2025-71362, has been identified in picklescan versions prior to 0.0.33. This issue stems from picklescan's failure to adequately detect unsafe deserialization patterns within numpy.f2py.crackfortran functions. Specifically, when these functions process data, they may call eval on arbitrary strings derived from pickle files, creating an arbitrary code execution vector. Attackers can craft malicious pickle files containing embedded code. If these untrusted files are subsequently loaded and processed by a vulnerable picklescan instance, the embedded malicious code will execute, granting the attacker control over the compromised system. This vulnerability poses a significant risk to applications and environments that handle or process pickle files from external or untrusted sources.

Attack Chain

Vulnerability Identification: An attacker identifies a target system or application that uses picklescan (version < 0.0.33) to process Python pickle files.
Malicious Pickle File Creation: The attacker crafts a specially designed pickle file that contains malicious Python code. This code is structured to exploit the unsafe deserialization flaw in numpy.f2py.crackfortran functions, ensuring that when the file is loaded, the eval function is called with the attacker's payload.
Delivery: The attacker delivers the malicious pickle file to the victim. This could be via email (as an attachment), through a compromised web application, or by placing it in a location where the victim's application is expected to load files (e.g., a shared drive, an untrusted repository).
User/Application Interaction: The victim's application or user, believing the pickle file to be legitimate or benign, initiates the loading process of the untrusted pickle file using the vulnerable picklescan library.
Vulnerable Deserialization: During the deserialization process, the picklescan library invokes numpy.f2py.crackfortran functions. Due to the CVE-2025-71362 vulnerability, these functions call eval on the arbitrary malicious strings embedded within the pickle file.
Arbitrary Code Execution: The eval call executes the attacker's embedded malicious code within the context of the vulnerable application, leading to arbitrary code execution on the host system.
Impact on System: With arbitrary code execution, the attacker can achieve various objectives, such as data exfiltration, installation of malware, establishment of persistence, or full system compromise.

Impact

The successful exploitation of CVE-2025-71362 allows for arbitrary code execution on the system running the vulnerable picklescan instance. This means an attacker could gain full control over the affected system, potentially leading to complete data compromise, installation of ransomware, deployment of backdoors, or lateral movement within the network. While specific victim counts or targeted sectors are not detailed in the NVD advisory, any organization or developer using affected versions of picklescan to process untrusted Python pickle files is at risk. The consequences range from data breach and operational disruption to severe reputational damage.

Recommendation

Patch CVE-2025-71362: Immediately upgrade picklescan to version 0.0.33 or later to mitigate CVE-2025-71362.
Implement Input Validation: Ensure that all pickle files processed by applications are from trusted sources and implement strict validation before deserialization.
Isolate Processing: If processing untrusted pickle files is unavoidable, perform the deserialization in a highly isolated environment (e.g., a secure sandbox or virtual machine) to contain potential arbitrary code execution.