CVE-2025-71362

picklescan - Arbitrary Code Execution via Unsafe Deserialization in numpy.f2py.crackfortran

CVSS 7.6 HIGHCWE-502

Vexday Risk Score

18Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7.6EPSS —KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

04 Jul 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

picklescan before 0.0.33 fails to detect unsafe deserialization when numpy.f2py.crackfortran functions call eval on arbitrary strings. Attackers can embed malicious code in pickle files that executes when loaded from untrusted sources.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Affected products

picklescan · picklescan

References

https://github.com/mmaitre314/picklescan/security/advisories/GHSA-r8g5-cgf2-4m4m https://www.vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-unsafe-deserialization-in-numpy-f2py-crackfortran