The flaw resides in picklescan versions prior to 0.0.33, where the tool calls the NumPy f2py function crackfortran that internally evaluates untrusted strings with Python’s eval. This evaluation is performed on data extracted from pickle files, allowing an attacker to embed arbitrary Python code that will be executed when the pickle is loaded. The weakness is a classic unsafe deserialization flaw (CWE-502) and provides the attacker with the ability to run any code with the privileges of the picklescan process.

The vulnerability affects the picklescan project developed by mmaitre314. All releases before 0.0.33 are listed as vulnerable; newer releases are not documented as affected.

The CVSS score of 7.6 classifies the vulnerability as high severity. The EPSS score of < 1 % indicates a very low but non-zero likelihood of exploitation, and the issue is not listed in the CISA KEV catalog, so no publicly known attacks are reported. The attack vector is inferred to be an attacker supplying a crafted pickle file to picklescan; when this file is processed, arbitrary code runs with the picklescan user’s permissions.