Executive brief
picklescan is a security tool used to scan Python "pickle" files and machine learning models for malicious code. A vulnerability exists where the tool fails to detect certain dangerous commands hidden within these files. If a user relies on this tool to verify a file and then opens it, an attacker could gain full control over the user's system or steal sensitive data.
Technical details
A detection bypass vulnerability exists in picklescan versions prior to 0.0.33. The tool's security scanner fails to identify the 'numpy.f2py.crackfortran.myeval' function when invoked via the '__reduce__' method in a serialized pickle file. An attacker can craft a malicious pickle file (often disguised as a machine learning model) that embeds arbitrary Python code using this specific NumPy function. Because picklescan marks the file as safe, a victim may proceed to load the file using 'pickle.load()', resulting in arbitrary remote code execution (RCE). The issue is addressed in version 0.0.33.
Affected products
- picklescan picklescan < 0.0.33
Timeline
- 2025-12-27: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: NVD publication and CVE assignment