Most recent entries from all

EUVD-2026-329268

2026-10-07T02:07:35.472991+00:00

EUVD-2026-329268

fkie_cve-2025-71339

2026-10-07T02:07:35.473023+00:00

Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran._eval_length gadget in pickle __reduce__ methods, allowing arbitrary code execution. Attackers can craft malicious pickle files that execute arbitrary Python code when loaded by victims who trust Picklescan's safety validation.

GHSA-6556-fwc2-fg2p — Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran._eval_length

2026-10-07T02:07:35.473055+00:00

Affected: PyPI: picklescan

### Summary

Picklescan uses the `numpy.f2py.crackfortran._eval_length` function (a NumPy F2PY helper) to execute arbitrary Python code during unpickling.

### Details

Picklescan fails to detect a malicious pickle that uses the gadget `numpy.f2py.crackfortran._eval_length` in `__reduce__`, allowing arbitrary command execution when the pickle is loaded. A crafted object returns this function plus attacker‑controlled arguments; the scan reports the file as safe, but pickle.load() triggers execution.

### PoC ```python class PoC: def __reduce__(self): from numpy.f2py.crackfortran import _eval_length return _eval_length, ("__import__('os').system('whoami')", None) ```

### Impact

- Arbitrary code execution on the victim machine once they load the “scanned as safe” pickle / model file. - Affects any workflow relying on Picklescan to vet untrusted pickle / PyTorch artifacts. - Enables supply‑chain poisoning of shared model files.

### Credits - [ac0d3r](https://github.com/ac0d3r) - [Tong Liu](https://lyutoon.github.io), Institute of information engineering, CAS

PYSEC-2026-1783 — Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran._eval_length