# CVE-2025-71339: picklescan RCE — Fixed in 0.0.33

🐍 PyPI

Not in CISA KEV

# CVE-2025-71339 — picklescan

[Fix: mmaitre314/picklescan#53](https://github.com/mmaitre314/picklescan/pull/53)

CVE-2025-71339 is a Deserialization of Untrusted Data vulnerability in picklescan. A fix is available for picklescan — see the affected versions and patch details below.

Picklescan - Arbitrary Code Execution via numpy.f2py.crackfortran.\_eval\_length Gadget

Also known as[GHSA-6556-fwc2-fg2p](/vulnerability/GHSA-6556-fwc2-fg2p)PYSEC-2026-1783

Published

Jun 22, 2026

Updated

Oct 28, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Nov 9, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

## Exploitation Status

### Proof-of-concept exploit code exists

-   CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
-   A successful exploit gives an attacker total control of the affected component, not partial access.

Exploitation and automatability from CISA’s SSVC triage for CVE-2025-71339.

## EPSS Exploitation Probability

[via FIRST.org ↗](https://www.first.org/epss/)

0.4%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs32th percentile — riskier than 32% of all scored CVEsHighest risk

0.00%0.34%0.68%1.02%0.3%0.5%0.4%0.4%Jul 26Nov 26Nov 26

Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/).

## Real-World Exposure

1 pkg affected

🐍`picklescan`

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

## Description

#### Summary

Picklescan uses the `numpy.f2py.crackfortran._eval_length` function (a NumPy F2PY helper) to execute arbitrary Python code during unpickling.

#### Details

Picklescan fails to detect a malicious pickle that uses the gadget `numpy.f2py.crackfortran._eval_length` in `__reduce__`, allowing arbitrary command execution when the pickle is loaded. A crafted object returns this function plus attacker‑controlled arguments; the scan reports the file as safe, but pickle.load() triggers execution.

#### PoC

```
class PoC:
    def __reduce__(self):
        from numpy.f2py.crackfortran import _eval_length
        return _eval_length, ("__import__('os').system('whoami')", None)
```

#### Impact

-   Arbitrary code execution on the victim machine once they load the “scanned as safe” pickle / model file.
-   Affects any workflow relying on Picklescan to vet untrusted pickle / PyTorch artifacts.
-   Enables supply‑chain poisoning of shared model files.

#### Credits

-   [ac0d3r](https://github.com/ac0d3r)
-   [Tong Liu](https://lyutoon.github.io), Institute of information engineering, CAS

## Affected Packages

1 total 1 fixed

Ecosystem

Package

Vulnerable range

Fix

🐍PyPI

`picklescan` 

all versions

0.0.33`pip install --upgrade 'picklescan==0.0.33'`

## Detection & mitigation playbook

Open-source dependency

1.  ### Detect
    
    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for picklescan, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
    
2.  ### Fix
    
    Update picklescan to 0.0.33 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-71339 is resolved across your whole dependency graph.
    
3.  ### Workarounds
    
    Do not deserialise data from untrusted sources: where the format allows it, restrict deserialisation to an explicit allowlist of expected types, and prefer a data-only format (JSON, Protobuf) over one that can reconstruct arbitrary objects until you can upgrade.
    

## Frequently Asked Questions

\### Summary Picklescan uses the \`numpy.f2py.crackfortran.\_eval\_length\` function (a NumPy F2PY helper) to execute arbitrary Python code during unpickling. ### Details Picklescan fails to detect a malicious pickle that uses the gadget \`numpy.f2py.crackfortran.\_eval\_length\` in \`\_\_reduce\_\_\`, allowing arbitrary command execution when the pickle is loaded. A crafted object returns this function plus attacker‑controlled arguments; the scan reports the file as safe, but pickle.load() triggers execution. ### PoC \`\`\`python class PoC: def \_\_reduce\_\_(self): from numpy.f2py.crackfortran imp

O3 Security · Impact-Aware SCA

### Is CVE-2025-71339 in your dependencies?

Find it across PyPI, including transitive dependencies.

[Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)