Technical impact
picklescan prior to 0.0.33 fails to detect malicious pickle files that invoke the numpy.f2py.crackfortran.myeval function through the reduce method. Attackers can embed arbitrary code within a pickle payload that bypasses picklescan’s detection logic and executes when the pickle is deserialized, resulting in uncontrolled code execution. The vulnerability is a classic deserialization flaw (CWE-502).
Affected Systems
The vulnerable product is picklescan provided by mmaitre314. Any installation running picklescan versions earlier than 0.0.33 is susceptible. No additional platform or build restrictions are noted in the advisory.
Risk and Exploitability
The CVSS score of 7.6 places this flaw in the high severity range, indicating that exploitation can cause significant damage. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed exploitation yet. Attackers can gain remote code execution by delivering a crafted pickle file to any picklescan-enabled process that loads untrusted data. Because the issue is purely a deserialization flaw, exploitation does not require authentication or privilege escalation; the presence of the flaw alone is sufficient for code execution.
Github GHSA