CVE-2025-71347: Picklescan < 0.0.33 Bypass – Arbitrary Code Execution in Pickle Detection

Technical summary

The vulnerability exists in picklescan's detection engine, which scans Python pickle bytecode for signs of code execution. The flaw is a bypass of those checks when the reduce() opcode invokes numpy.f2py.crackfortran.param_eval as a callable. This NumPy function, intended for parsing Fortran code during f2py compilation, can be abused to execute arbitrary Python code during deserialization. Because picklescan's allowlist or detection patterns do not account for this gadget chain, malicious pickle files can deliver RCE while passing picklescan's safety inspection. The root cause is incomplete gadget chain enumeration in the detection logic.

Business impact

Organizations using picklescan to validate untrusted pickle data—such as those accepting serialized models, cached objects, or data from third-party sources—face unexpected arbitrary code execution risk. A breach of trust in picklescan's output could lead to supply-chain compromises, data exfiltration, or lateral movement if the vulnerable code runs in a privileged or network-adjacent context. The impact is particularly acute for ML/data science teams that may exchange pickle files with external collaborators or auto-load cached models without secondary validation.

Affected systems

Any application using picklescan versions before 0.0.33 to validate or check pickle files is vulnerable. This includes security scanning tools, CI/CD pipelines, and data processing frameworks that depend on picklescan's output to make trust decisions. The underlying attack requires an attacker to craft a malicious pickle file and deliver it to a system where it will be deserialized; systems that do not deserialize pickle files, or that do not use picklescan, are not affected.

Exploitability

Exploitation requires an attacker to (1) craft a malicious pickle file using the numpy.f2py.crackfortran.param_eval gadget, (2) deliver it to a target application, and (3) have the application deserialize it. The CVSS score of 8.1 reflects that network delivery is possible and no privileges are required, but user interaction is noted (UI:R), likely indicating that some action—such as loading a file or triggering a data pipeline—is needed. Once a malicious pickle reaches the deserialization step, the code executes with the privileges of the Python process.

Remediation

Update picklescan to version 0.0.33 or later immediately. If you cannot patch immediately, do not rely solely on picklescan to validate untrusted pickle data; implement additional isolation (e.g., deserialize in a sandbox or restricted container) and avoid deserializing pickles from untrusted sources. Verify your picklescan version in your environment and review any data pipelines or cache systems that depend on it.

Patch guidance

Upgrade picklescan to 0.0.33 or newer. Check your requirements.txt, setup.py, or dependency manifest for picklescan versions and update via your package manager (e.g., pip install --upgrade picklescan). Test the upgraded version in a non-production environment to confirm compatibility with your detection workflows. Verify against the official picklescan GitHub repository and release notes to confirm the version addresses CVE-2025-71347.

Detection guidance

Audit your codebase and infrastructure for uses of picklescan versions < 0.0.33. Check package manifests, container images, and CI/CD configurations. Monitor for pickle deserialization events (especially from untrusted sources) in Python logs. If you are a picklescan user, review recent pickle files that were validated and consider re-scanning them with the patched version. Look for unexpected process execution or code loads that coincide with pickle file ingestion.

Why prioritize this

This vulnerability should be prioritized because it directly undermines the security control that picklescan is meant to provide. Any organization trusting picklescan for threat detection faces false negatives—the tool will pass dangerous files. The high CVSS score (8.1) and the ease of exploit delivery via network vectors make this a critical update for affected users. Delay exposes you to silent compromise through data pipelines and model sharing workflows.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects: network-accessible attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), user interaction required (UI:R), and high confidentiality and integrity impact (C:H, I:H). There is no availability impact noted. The score is elevated because exploitation leads to arbitrary code execution, but it stops short of critical (9.0+) because user interaction—such as explicitly loading a file or running a pipeline—is required to trigger deserialization.

Frequently asked questions