https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 02:07:31 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-329268 EUVD-2026-329268 https://cve.radiocsirt.org/vuln/euvd-2026-329268 https://cve.radiocsirt.org/vuln/fkie_cve-2025-71339 <p>Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran._eval_length gadget in pickle __reduce__ methods, allowing arbitrary code execution. Attackers can craft malicious pickle files that execute arbitrary Python code when loaded by victims who trust Picklescan&#39;s safety validation.</p> <p>Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran._eval_length gadget in pickle __reduce__ methods, allowing arbitrary code execution. Attackers can craft malicious pickle files that execute arbitrary Python code when loaded by victims who trust Picklescan&#39;s safety validation.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-71339 https://cve.radiocsirt.org/vuln/ghsa-6556-fwc2-fg2p <p><strong>Affected:</strong> PyPI: picklescan</p> <p>### Summary</p> <p>Picklescan uses the `numpy.f2py.crackfortran._eval_length` function (a NumPy F2PY helper) to execute arbitrary Python code during unpickling.</p> <p>### Details</p> <p>Picklescan fails to detect a malicious pickle that uses the gadget `numpy.f2py.crackfortran._eval_length` in `__reduce__`, allowing arbitrary command execution when the pickle is loaded. A crafted object returns this function plus attacker‑controlled arguments; the scan reports the file as safe, but pickle.load() triggers execution.</p> <p>### PoC ```python class PoC: def __reduce__(self): from numpy.f2py.crackfortran import _eval_length return _eval_length, (&#34;__import__(&#39;os&#39;).system(&#39;whoami&#39;)&#34;, None) ```</p> <p>### Impact</p> <p>- Arbitrary code execution on the victim machine once they load the “scanned as safe” pickle / model file. - Affects any workflow relying on Picklescan to vet untrusted pickle / PyTorch artifacts. - Enables supply‑chain poisoning of shared model files.</p> <p>### Credits - [ac0d3r](https://github.com/ac0d3r) - [Tong Liu](https://lyutoon.github.io), Institute of information engineering, CAS</p> <p><strong>Affected:</strong> PyPI: picklescan</p> <p>### Summary</p> <p>Picklescan uses the `numpy.f2py.crackfortran._eval_length` function (a NumPy F2PY helper) to execute arbitrary Python code during unpickling.</p> <p>### Details</p> <p>Picklescan fails to detect a malicious pickle that uses the gadget `numpy.f2py.crackfortran._eval_length` in `__reduce__`, allowing arbitrary command execution when the pickle is loaded. A crafted object returns this function plus attacker‑controlled arguments; the scan reports the file as safe, but pickle.load() triggers execution.</p> <p>### PoC ```python class PoC: def __reduce__(self): from numpy.f2py.crackfortran import _eval_length return _eval_length, (&#34;__import__(&#39;os&#39;).system(&#39;whoami&#39;)&#34;, None) ```</p> <p>### Impact</p> <p>- Arbitrary code execution on the victim machine once they load the “scanned as safe” pickle / model file. - Affects any workflow relying on Picklescan to vet untrusted pickle / PyTorch artifacts. - Enables supply‑chain poisoning of shared model files.</p> <p>### Credits - [ac0d3r](https://github.com/ac0d3r) - [Tong Liu](https://lyutoon.github.io), Institute of information engineering, CAS</p> https://cve.radiocsirt.org/vuln/ghsa-6556-fwc2-fg2p https://cve.radiocsirt.org/vuln/pysec-2026-1783 <p><strong>Affected:</strong> PyPI: picklescan</p> <p>### Summary</p> <p>Picklescan uses the `numpy.f2py.crackfortran._eval_length` function (a NumPy F2PY helper) to execute arbitrary Python code during unpickling.</p> <p>### Details</p> <p>Picklescan fails to detect a malicious pickle that uses the gadget `numpy.f2py.crackfortran._eval_length` in `__reduce__`, allowing arbitrary command execution when the pickle is loaded. A crafted object returns this function plus attacker‑controlled arguments; the scan reports the file as safe, but pickle.load() triggers execution.</p> <p>### PoC ```python class PoC: def __reduce__(self): from numpy.f2py.crackfortran import _eval_length return _eval_length, (&#34;__import__(&#39;os&#39;).system(&#39;whoami&#39;)&#34;, None) ```</p> <p>### Impact</p> <p>- Arbitrary code execution on the victim machine once they load the “scanned as safe” pickle / model file. - Affects any workflow relying on Picklescan to vet untrusted pickle / PyTorch artifacts. - Enables supply‑chain poisoning of shared model files.</p> <p>### Credits - [ac0d3r](https://github.com/ac0d3r) - [Tong Liu](https://lyutoon.github.io), Institute of information engineering, CAS</p> <p><strong>Affected:</strong> PyPI: picklescan</p> <p>### Summary</p> <p>Picklescan uses the `numpy.f2py.crackfortran._eval_length` function (a NumPy F2PY helper) to execute arbitrary Python code during unpickling.</p> <p>### Details</p> <p>Picklescan fails to detect a malicious pickle that uses the gadget `numpy.f2py.crackfortran._eval_length` in `__reduce__`, allowing arbitrary command execution when the pickle is loaded. A crafted object returns this function plus attacker‑controlled arguments; the scan reports the file as safe, but pickle.load() triggers execution.</p> <p>### PoC ```python class PoC: def __reduce__(self): from numpy.f2py.crackfortran import _eval_length return _eval_length, (&#34;__import__(&#39;os&#39;).system(&#39;whoami&#39;)&#34;, None) ```</p> <p>### Impact</p> <p>- Arbitrary code execution on the victim machine once they load the “scanned as safe” pickle / model file. - Affects any workflow relying on Picklescan to vet untrusted pickle / PyTorch artifacts. - Enables supply‑chain poisoning of shared model files.</p> <p>### Credits - [ac0d3r](https://github.com/ac0d3r) - [Tong Liu](https://lyutoon.github.io), Institute of information engineering, CAS</p> https://cve.radiocsirt.org/vuln/pysec-2026-1783