PT-2026-51492 · Picklescan · Picklescan

Coolwindhf · Published 2026-06-23 · Updated 2026-06-23 · CVE-2025-71365

NVD

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

picklescan before 0.0.33 fails to detect malicious pickle files that invoke numpy.f2py.crackfortran.myeval function through the reduce method. Attackers can craft malicious pickle files embedding arbitrary code that evades picklescan detection and executes remote code when loaded.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-71365

Affected Products

Picklescan

References · 3

• 🔥 https://github.com/mmaitre314/picklescan/security/advisories/GHSA-3329-ghmp-jmv5 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-71365 · Security Note
• https://vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-numpy-f2py-crackfortran-myeval-detection-bypass · Note