7.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-71339

CVE-2025-71339: Picklescan - Arbitrary Code Execution via numpy.f2py.crackfortran._eval_length Gadget

Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran._eval_length gadget in pickle reduce methods, allowing arbitrary code execution. Attackers can craft malicious pickle files that execute arbitrary Python code when loaded by victims who trust Picklescan's safety validation.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-71339

CVE-2025-71339:

7.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
picklescan	pip	< 0.0.33	0.0.33

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability in Picklescan allows for a remote code execution (RCE) by failing to detect a malicious pickle that uses the numpy.f2py.crackfortran._eval_length function. The root cause of this vulnerability is an incomplete blocklist and a flawed detection logic in the scanner.

The analysis of the patch in commit 70c1c6c31beb6baaf52c8db1b6c3c0e84a6f9dab reveals two key changes:

The _unsafe_globals dictionary in src/picklescan/scanner.py was updated to include "numpy.f2py": "*". This explicitly marks the numpy.f2py module as dangerous.
The logic in the _build_scan_result_from_raw_globals function was improved to recursively check for dangerous parent modules. The original logic only checked the top-level module, which allowed the dangerous numpy.f2py.crackfortran._eval_length to go undetected because numpy itself was not on the blocklist.

The vulnerable function is _build_scan_result_from_raw_globals because it contained the flawed logic that failed to detect the malicious pickle. When Picklescan analyzes a pickle file, this function is called to determine the safety of the globals used. Due to the vulnerability, it would incorrectly classify the malicious pickle as safe, leading to a potential RCE when the pickle is loaded by the user.

Vulnerable functions

_build_scan_result_from_raw_globals

src/picklescan/scanner.py

The vulnerability lies in the insufficient detection logic within the `_build_scan_result_from_raw_globals` function. Before the patch, the function only checked the top-level module for a given global, which was not sufficient for nested modules. For instance, for the dangerous global `numpy.f2py.crackfortran._eval_length`, the check was performed only for the `numpy` module, which was not on the blocklist. The patch rectifies this by iterating through all parent modules (e.g., `numpy.f2py`) and checking if any of them are on the blocklist, thus correctly identifying `numpy.f2py.crackfortran._eval_length` as dangerous after `numpy.f2py` was added to the blocklist.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.