CVE-2025-71339

Name of the Vulnerable Software and Affected Versions Picklescan versions prior to 0.0.33

Description Picklescan fails to detect the numpy.f2py.crackfortran. eval length gadget within pickle reduce methods. This allows attackers to craft malicious pickle files that execute arbitrary Python code when loaded by users who rely on Picklescan's safety validation. The issue occurs because a crafted object can return the eval length function with attacker-controlled arguments; while the scan reports the file as safe, the pickle.load() function triggers the execution of the code.

Recommendations Update to version 0.0.33 or later.