Picklescan Arbitrary Code Execution via Malicious Pickle Files

Executive Summary

CVE-2025-71372 is a vulnerability in Picklescan versions before 0.0.33 where the tool fails to detect the numpy.f2py.crackfortran.getlincoef gadget in pickle __reduce__ methods.

This flaw allows attackers to craft malicious pickle files that execute arbitrary Python code when loaded, bypassing Picklescan's safety checks.

The vulnerability enables supply-chain poisoning of shared model files by allowing arbitrary code execution during unpickling.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to arbitrary code execution on systems that use Picklescan to validate pickle files.

Attackers can craft malicious pickle files that appear safe during scanning but execute harmful Python code when loaded.

This can result in supply-chain poisoning of shared model files, potentially compromising workflows that rely on these files.

Such an attack could allow unauthorized system commands to run, leading to data breaches or system compromise.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves malicious pickle files that execute arbitrary Python code when loaded, bypassing Picklescan's safety checks. Detection involves scanning pickle files with a version of Picklescan that correctly identifies the numpy.f2py.crackfortran.getlincoef gadget.

To detect this vulnerability, ensure you use Picklescan version 0.0.33 or later, as earlier versions fail to detect the malicious gadget.

A suggested command to scan a pickle file is:

• picklescan scan <pickle_file>

If you are using an older version of Picklescan, it may not flag malicious files containing the numpy.f2py.crackfortran.getlincoef gadget. Therefore, upgrading Picklescan is critical for detection.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade Picklescan to version 0.0.33 or later, which includes the fix to detect the malicious numpy.f2py.crackfortran.getlincoef gadget in pickle files.

Additionally, avoid loading pickle files from untrusted or unauthenticated sources, as these can contain malicious code that executes upon unpickling.

Review and validate any shared model files or pickle artifacts before use to prevent supply-chain poisoning.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows arbitrary code execution through malicious pickle files, enabling supply-chain poisoning of shared model files. Such unauthorized code execution and potential data manipulation or exposure could lead to violations of data protection and security requirements mandated by standards like GDPR and HIPAA.

Specifically, the failure to detect malicious pickle files may result in unauthorized access or alteration of sensitive data, which compromises confidentiality and integrity. This undermines compliance with regulations that require safeguarding personal and health information against unauthorized access and ensuring secure software supply chains.

Useful 0 Not Useful 0