Ac0D3R

**Name of the Vulnerable Software and Affected Versions** Picklescan versions prior to 0.0.33 **Description** Picklescan fails to detect the `numpy.f2py.crackfortran. eval length` gadget within pickle ` reduce ` methods. This allows attackers to craft malicious pickle files that execute arbitrary Python code when loaded by users who rely on Picklescan's safety validation. The issue occurs because a crafted object can return the ` eval length` function with attacker-controlled arguments; while the scan reports the file as safe, the `pickle.load()` function triggers the execution of the code. **Recommendations** Update to version 0.0.33 or later.

**Name of the Vulnerable Software and Affected Versions** Picklescan versions prior to 0.0.33 **Description** Picklescan fails to detect the `numpy.f2py.crackfortran.getlincoef` gadget within pickle ` reduce ` methods. This allows attackers to craft malicious pickle files that execute arbitrary Python code upon loading, bypassing safety checks and enabling supply-chain poisoning of shared model files. **Recommendations** Update Picklescan to version 0.0.33 or later.