picklescan - Arbitrary Code Execution via numpy.f2py.crackfortran.myeval Detection Bypass
Vulnerability Description
picklescan before 0.0.33 fails to detect malicious pickle files that invoke numpy.f2py.crackfortran.myeval function through the reduce method. Attackers can craft malicious pickle files embedding arbitrary code that evades picklescan detection and executes remote code when loaded.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-71365
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- CoolwindHF
References
More from picklescan
View All →Affected Vendor
picklescan
View all reports →