CVE-2025-71372: Picklescan Gadget Chain Bypass Allows Arbitrary Code Execution

Technical summary

CVE-2025-71372 is a gadget-chain bypass in Picklescan's pickle deserialization inspection logic. The vulnerability exploits the numpy.f2py.crackfortran.getlincoef gadget within __reduce__ methods, a known attack vector in Python's pickle protocol that enables arbitrary code execution. Picklescan's detection engine failed to identify and block this particular gadget chain, leaving a gap in its security model. The issue is classified as Unsafe Deserialization (CWE-502) and affects the integrity of Picklescan's core protective mechanism.

Business impact

Organizations using Picklescan to validate pickle files in machine learning pipelines, data science workflows, or any supply-chain context face a critical trust gap. Attackers can poison shared model repositories, training datasets, or cached pickle objects with code that executes silently during deserialization. This undermines the entire risk mitigation strategy of teams relying on Picklescan, potentially leading to undetected compromise of data science infrastructure, intellectual property theft, lateral movement, or data exfiltration. The impact is amplified in collaborative environments where pickle files are exchanged across teams or organizations.

Affected systems

Picklescan versions prior to 0.0.33 are vulnerable. Any system that depends on Picklescan to validate untrusted pickle input is at risk, particularly data science platforms, machine learning model registries, and data processing pipelines that accept serialized Python objects from external or semi-trusted sources.

Exploitability

Exploitability is moderate to high. The attack requires an attacker to craft a malicious pickle file and convince a user to load it through a system protected by Picklescan, or to inject the file into a supply chain (model repository, dataset distribution, shared storage). The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U) indicates network accessibility, low attack complexity, and user interaction required—a realistic scenario in collaborative ML environments. No authentication is required to create the malicious payload, though successful exploitation depends on the victim using an affected Picklescan version.

Remediation

Upgrade Picklescan to version 0.0.33 or later, which adds detection for the numpy.f2py.crackfortran.getlincoef gadget chain. Organizations should prioritize this patch if Picklescan is used in production pipelines for model or data validation. As an interim measure, consider additional input validation, sandboxing of pickle deserialization, or avoiding pickle format altogether in favor of safer serialization formats (JSON, Protocol Buffers, etc.) where feasible.

Patch guidance

Update Picklescan from the official Python Package Index (PyPI) to version 0.0.33 or later. Verify the package signature and validate against the vendor's release notes. For organizations with pinned dependencies, update your requirements.txt or constraints file immediately. Test the upgraded Picklescan against your existing pickle validation workflows to ensure no regressions in detection or performance. If you maintain private forks or mirrors of Picklescan, backport the gadget-detection fix before resuming use.

Detection guidance

Monitor Picklescan logs and model-loading events for unusual pickle files or validation errors. Review any pickle files that were processed by Picklescan versions before 0.0.33 and re-scan them with the patched version to identify potential bypass attempts. Check for unexpected code execution, process spawning, or file access during or immediately after pickle deserialization. In data science environments, audit data pipeline logs for indicators of malicious numpy.f2py imports or crackfortran function calls, and inspect model repositories for recently added or modified pickle artifacts. Implement integrity checks (hashing, signing) on critical pickle files to detect tampering.

Why prioritize this

This vulnerability directly undermines a security control that teams explicitly depend on. Picklescan users have made a conscious decision to rely on its gadget detection; this bypass invalidates that decision and creates a false sense of security. The combination of network accessibility, low attack complexity, high confidentiality and integrity impact, and the appeal to attackers of compromising ML supply chains makes this a high-priority patch despite the user-interaction requirement. Organizations should treat this as urgent if Picklescan is in their critical path for model or data validation.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects network-accessible exploitation (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), and high impact on confidentiality and integrity (C:H/I:H). The user interaction requirement (UI:R) moderates the score somewhat, but in collaborative or open-source contexts where pickle sharing is common, this is a realistic prerequisite rather than a strong mitigant. The bounded scope (S:U) limits availability impact but does not reduce the severity of code execution and data compromise.

Frequently asked questions