GHSA-rrxm-2pvv-m66x

Suggest an improvement
Source
https://github.com/advisories/GHSA-rrxm-2pvv-m66x
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-rrxm-2pvv-m66x/GHSA-rrxm-2pvv-m66x.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-rrxm-2pvv-m66x
Published
2025-12-30T15:18:16Z
Modified
2025-12-30T15:38:05.334043Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.getlincoef
Details

Summary

Picklescan uses the numpy.f2py.crackfortran.getlincoef function (a NumPy F2PY helper) to execute arbitrary Python code during unpickling.

Details

Picklescan fails to detect a malicious pickle that uses the gadget numpy.f2py.crackfortran.getlincoef in __reduce__, allowing arbitrary command execution when the pickle is loaded. A crafted object returns this function plus attacker‑controlled arguments; the scan reports the file as safe, but pickle.load() triggers execution.

PoC

class PoC:
    def __reduce__(self):
        from numpy.f2py.crackfortran import getlincoef
        return getlincoef, ("__import__('os').system('whoami')", None)

Impact

  • Arbitrary code execution on the victim machine once they load the “scanned as safe” pickle / model file.
  • Affects any workflow relying on Picklescan to vet untrusted pickle / PyTorch artifacts.
  • Enables supply‑chain poisoning of shared model files.

Credits

Database specific 
{
    "severity": "HIGH",
    "github_reviewed_at": "2025-12-30T15:18:16Z",
    "cwe_ids": [
        "CWE-502",
        "CWE-94"
    ],
    "nvd_published_at": null,
    "github_reviewed": true
}
References

Affected packages

PyPI / picklescan

Package

Name
picklescan
View open source insights on deps.dev
Purl
pkg:pypi/picklescan

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.0.33

Affected versions

0.*

0.0.1
0.0.2
0.0.3
0.0.4
0.0.5
0.0.6
0.0.7
0.0.8
0.0.9
0.0.10
0.0.11
0.0.12
0.0.13
0.0.14
0.0.15
0.0.16
0.0.17
0.0.18
0.0.19
0.0.20
0.0.21
0.0.22
0.0.23
0.0.24
0.0.25
0.0.26
0.0.27
0.0.28
0.0.29
0.0.30
0.0.31
0.0.32

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-rrxm-2pvv-m66x/GHSA-rrxm-2pvv-m66x.json"