PT-2026-51383 · Picklescan · Picklescan

Ac0D3R + 1 · Published 2026-06-22 · Updated 2026-06-22 · CVE-2025-71339

Mitre

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran. eval length gadget in pickle reduce methods, allowing arbitrary code execution. Attackers can craft malicious pickle files that execute arbitrary Python code when loaded by victims who trust Picklescan's safety validation.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-71339

Affected Products

Picklescan

References · 3

• https://github.com/mmaitre314/picklescan/security/advisories/GHSA-6556-fwc2-fg2p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-71339 · Security Note
• https://vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-numpy-f2py-crackfortran-eval-length-gadget · Note