Executive Summary

This vulnerability exists in Picklescan versions before 0.0.33, where the software fails to detect a specific gadget called numpy.f2py.crackfortran._eval_length within pickle __reduce__ methods.

Because of this failure, attackers can create malicious pickle files that execute arbitrary Python code when these files are loaded by users who rely on Picklescan's safety validation.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows attackers to execute arbitrary Python code on a victim's system by tricking them into loading a malicious pickle file that bypasses Picklescan's safety checks.

This can lead to unauthorized actions, potential system compromise, data manipulation, or other malicious activities depending on the attacker's intent.

Useful 0 Not Useful 0