{"id":"CVE-2025-71372","aliases":["GHSA-rrxm-2pvv-m66x"],"url":"https://o3.security/vulnerability/CVE-2025-71372","summary":"Picklescan - Arbitrary Code Execution via numpy.f2py.crackfortran.getlincoef Gadget","details":"### Summary\n\nPicklescan uses the `numpy.f2py.crackfortran.getlincoef` function (a NumPy F2PY helper) to execute arbitrary Python code during unpickling.\n\n### Details\n\nPicklescan fails to detect a malicious pickle that uses the gadget `numpy.f2py.crackfortran.getlincoef` in `__reduce__`, allowing arbitrary command execution when the pickle is loaded. A crafted object returns this function plus attacker‑controlled arguments; the scan reports the file as safe, but pickle.load() triggers execution.\n\n### PoC\n```python\nclass PoC:\n    def __reduce__(self):\n        from numpy.f2py.crackfortran import getlincoef\n        return getlincoef, (\"__import__('os').system('whoami')\", None)\n```\n\n### Impact\n\n- Arbitrary code execution on the victim machine once they load the “scanned as safe” pickle / model file.\n- Affects any workflow relying on Picklescan to vet untrusted pickle / PyTorch artifacts.\n- Enables supply‑chain poisoning of shared model files.\n\n### Credits\n- [ac0d3r](https://github.com/ac0d3r)\n- [Tong Liu](https://lyutoon.github.io), Institute of information engineering, CAS","published":"2026-07-04T01:23:40.728Z","modified":"2026-10-28T02:30:53.355419273Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"picklescan","fixedVersion":"0.0.33"}],"fix":{"url":"https://github.com/mmaitre314/picklescan/pull/53","label":"mmaitre314/picklescan#53"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71372.json"},{"type":"ADVISORY","url":"https://github.com/mmaitre314/picklescan/security/advisories/GHSA-rrxm-2pvv-m66x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71372"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-numpy-f2py-crackfortran-getlincoef-gadget"},{"type":"WEB","url":"https://github.com/mmaitre314/picklescan/pull/53"},{"type":"WEB","url":"https://github.com/mmaitre314/picklescan/commit/70c1c6c31beb6baaf52c8db1b6c3c0e84a6f9dab"},{"type":"PACKAGE","url":"https://github.com/mmaitre314/picklescan"},{"type":"WEB","url":"https://github.com/mmaitre314/picklescan/releases/tag/v0.0.33"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:53.355419273Z"}}