{"id":"GHSA-r8g5-cgf2-4m4m","summary":"Picklescan missing detection when calling numpy.f2py.crackfortran.getlincoef","details":"### Summary\n\nAn unsafe deserialization vulnerability allows an attacker to execute arbitrary code on the host when loading a malicious pickle payload from an untrusted source.\n\n### Details\n\nThe `numpy.f2py.crackfortran` module exposes many functions that call `eval` on arbitrary strings of values. This is the case for `getlincoef` and `_eval_length`. This list is probably not exhaustive.\n\nAccording to https://numpy.org/doc/stable/reference/security.html#advice-for-using-numpy-on-untrusted-data, the whole `numpy.f2py` should be considered unsafe when loading a pickle.\n\n### PoC\n\n```python\nfrom numpy.f2py.crackfortran import getlincoef\n\nclass EvilClass:\n    def __reduce__(self):\n        payload = \"__import__('os').system('echo \\\"successful attack\\\"')\"\n        return getlincoef, (payload, [])\n```\n\n### Impact\n\nWho is impacted? Any organization or individual relying on `picklescan` to detect malicious pickle files from untrusted sources.\nWhat is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.\nSupply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.\n\n### Note\n\nThe problem was originally reported to the joblib project, but this was deemed unrelated to joblib itself. However, I checked that `picklescan` was indeed vulnerable.","aliases":["CVE-2025-71362"],"modified":"2026-07-08T07:23:55.133962206Z","published":"2025-12-29T15:27:59Z","database_specific":{"cwe_ids":["CWE-502"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2025-12-29T15:27:59Z","nvd_published_at":null},"references":[{"type":"WEB","url":"https://github.com/mmaitre314/picklescan/security/advisories/GHSA-r8g5-cgf2-4m4m"},{"type":"WEB","url":"https://github.com/mmaitre314/picklescan/pull/53"},{"type":"WEB","url":"https://github.com/mmaitre314/picklescan/commit/70c1c6c31beb6baaf52c8db1b6c3c0e84a6f9dab"},{"type":"PACKAGE","url":"https://github.com/mmaitre314/picklescan"},{"type":"WEB","url":"https://github.com/mmaitre314/picklescan/releases/tag/v0.0.33"}],"affected":[{"package":{"name":"picklescan","ecosystem":"PyPI","purl":"pkg:pypi/picklescan"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.33"}]}],"versions":["0.0.1","0.0.10","0.0.11","0.0.12","0.0.13","0.0.14","0.0.15","0.0.16","0.0.17","0.0.18","0.0.19","0.0.2","0.0.20","0.0.21","0.0.22","0.0.23","0.0.24","0.0.25","0.0.26","0.0.27","0.0.28","0.0.29","0.0.3","0.0.30","0.0.31","0.0.32","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-r8g5-cgf2-4m4m/GHSA-r8g5-cgf2-4m4m.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P"}]}