Arbitrary Code Execution Vulnerability in Picklescan by Maitre314

CVE-2025-71362

What is CVE-2025-71362?

The affected version of Picklescan prior to 0.0.33 has a critical vulnerability that occurs during the deserialization process. The issue arises when the numpy.f2py.crackfortran functions utilize the eval method on arbitrary strings without adequate validation. This oversight enables attackers to insert and execute malicious code by embedding harmful payloads within pickle files. When such files are loaded from untrusted sources, the embedded code can compromise the system, leading to severe security breaches. It is imperative for users to upgrade to the latest version of Picklescan to mitigate this risk.

References