CVE-2025-71365 | BDVDB-2026-342199 Detail
picklescanpicklescan
Description#
picklescan before 0.0.33 fails to detect malicious pickle files that invoke numpy.f2py.crackfortran.myeval function through the reduce method. Attackers can craft malicious pickle files embedding arbitrary code that evades picklescan detection and executes remote code when loaded.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact none. Attack vector: network.
Weaknesses#
- CWE-502 Deserialization of Untrusted Data
References#
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.