CVE-2025-71362: picklescan Detection Bypass via numpy.f2py.crackfortran eval Injection

Technical summary

CVE-2025-71362 is a detection bypass vulnerability in picklescan's static analysis of pickle bytecode. The vulnerability stems from picklescan's failure to detect unsafe deserialization patterns when numpy.f2py.crackfortran functions invoke eval() on attacker-controlled string arguments. An adversary can craft a malicious pickle file that reconstructs these function calls with arbitrary string payloads. During unpickling, the eval() call executes the attacker's code in the context of the Python interpreter. The root cause is insufficient coverage of numpy's f2py module in picklescan's safety rules, allowing a known unsafe pattern to remain undetected.

Business impact

Organizations using picklescan to validate pickle files before processing untrusted data face a critical gap in their defense. Machine learning pipelines, data science workflows, and inter-process communication systems that rely on pickled Python objects are vulnerable if picklescan is their primary security control. A compromised pickle file could lead to arbitrary code execution on production systems, data exfiltration, lateral movement, or supply-chain attacks if pickle files are exchanged between trusted parties. The impact is elevated for teams that have reduced their security scrutiny based on a false sense of protection from picklescan validation.

Affected systems

The vulnerability affects picklescan versions before 0.0.33. Any Python environment importing and using an affected version of picklescan to deserialize pickle files is at risk. This includes data science platforms (Jupyter, JupyterHub), machine learning frameworks that serialize models as pickles, and custom applications that parse untrusted pickle data. The vulnerability does not affect pickle security in general—only picklescan's ability to detect and warn about these specific attacks.

Exploitability

Exploitation requires an attacker to craft a malicious pickle file and convince or trick a user into deserializing it. The attack vector is network-based (email attachment, malicious download, compromised repository), though local file access is also possible. No special privileges are required on the attacker side, and the attack succeeds automatically once the pickle is unpickled—no additional interaction is needed beyond the user opening the file. The use of a legitimate numpy function as the attack vector makes detection and forensic analysis more difficult. CVSS 8.1 (HIGH) reflects the combination of network exploitability, ease of attack, and high impact on confidentiality and integrity.

Remediation

Upgrade picklescan to version 0.0.33 or later. This patched version includes detection rules for the numpy.f2py.crackfortran eval pattern. After upgrading, re-scan any pickle files that were previously validated with older versions if they came from untrusted sources. Organizations should also consider defense-in-depth measures: run pickle deserialization in isolated sandboxed environments, restrict network access to systems that parse pickles, and implement code review for any custom pickle handling logic.

Patch guidance

Apply the fix by updating picklescan via your Python package manager (pip install --upgrade picklescan). Verify that the installed version is 0.0.33 or later by running pip show picklescan or checking the version in your lockfile. No configuration changes are required after upgrade. Test the patched version against any pickle files you maintain to ensure compatibility and that detection now flags previously undetectable payloads in test cases.

Detection guidance

Monitor logs for unpickling operations that involve numpy or f2py modules, particularly any eval() calls with string reconstruction. Use static analysis on pickle files in your repositories: tools like pickletools.dis() can help identify suspicious bytecode patterns. Network detection should focus on identifying pickle files (.pkl, .pickle, .joblib files containing pickle data) being transferred over unencrypted channels or from unexpected sources. Endpoint detection should alert on Python processes spawned by deserialization operations, especially those with high privilege levels or network outbound connections.

Why prioritize this

HIGH priority due to the combination of a network-exploitable attack vector, ease of weaponization (pickle files are common in data science), and the fact that picklescan is explicitly designed to prevent this class of attack. The bypass undermines trust in a widely-used security tool. Organizations cannot simply apply picklescan and forget about pickle security—they must ensure they are running a patched version. The 8.1 CVSS score and lack of KEV status should not be misinterpreted as low urgency; this is a direct attack on a security control.

Risk score, explained

CVSS 3.1 score of 8.1 (HIGH) is justified by: Attack Vector: Network (AV:N) – malicious pickles can be distributed remotely; Attack Complexity: Low (AC:L) – no special conditions required; Privileges Required: None (PR:N) – unauthenticated attacker; User Interaction: Required (UI:R) – user must deserialize the pickle; Scope: Unchanged (S:U); Confidentiality Impact: High (C:H) – arbitrary code execution can steal data; Integrity Impact: High (I:H) – code execution allows modification of system state; Availability Impact: None (A:N) – resource exhaustion is possible but not the primary threat. The score appropriately reflects a serious but not critical vulnerability, as it requires user action to trigger and does not enable privilege escalation by default.

Frequently asked questions