N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-6556-fwc2-fg2p

GHSA-6556-fwc2-fg2p: Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran._eval_length

Summary

Picklescan uses the numpy.f2py.crackfortran._eval_length function (a NumPy F2PY helper) to execute arbitrary Python code during unpickling.

Details

Picklescan fails to detect a malicious pickle that uses the gadget numpy.f2py.crackfortran._eval_length in __reduce__, allowing arbitrary command execution when the pickle is loaded. A crafted object returns this function plus attacker‑controlled arguments; the scan reports the file as safe, but pickle.load() triggers execution.

PoC

class PoC:
    def __reduce__(self):
        from numpy.f2py.crackfortran import _eval_length
        return _eval_length, ("__import__('os').system('whoami')", None)

Impact

Arbitrary code execution on the victim machine once they load the “scanned as safe” pickle / model file.
Affects any workflow relying on Picklescan to vet untrusted pickle / PyTorch artifacts.
Enables supply‑chain poisoning of shared model files.

Credits

ac0d3r
Tong Liu, Institute of information engineering, CAS

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-6556-fwc2-fg2p

GHSA-6556-fwc2-fg2p:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
picklescan	pip	< 0.0.33	0.0.33

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, GHSA-6556-fwc2-fg2p, describes a bypass in the picklescan scanner that allows a malicious pickle to go undetected. The exploit uses the numpy.f2py.crackfortran._eval_length function, which can execute arbitrary code. The scanner failed to identify this as a threat.

The analysis of the patch in commit 70c1c6c31beb6baaf52c8db1b6c3c0e84a6f9dab reveals two key changes in src/picklescan/scanner.py:

The _unsafe_globals dictionary, which serves as a blocklist, was updated to include "numpy.f2py": "*". This marks the entire numpy.f2py module and all its submodules and functions as dangerous.
The core of the vulnerability within the scanner's code was in the _build_scan_result_from_raw_globals function. Its logic for checking if a submodule belongs to a blocked parent module was insufficient. The patch replaces the simplistic check with a loop that iterates through all parent parts of a module path (e.g., for a.b.c, it checks a and a.b).

This flawed logic in _build_scan_result_from_raw_globals is the root cause of the vulnerability. When scanning a pickle containing the malicious gadget, this function would be called and would fail to correctly identify the threat, returning a 'safe' result. Therefore, scanner._build_scan_result_from_raw_globals is the primary vulnerable function that would appear in a runtime profile during the scanning process.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-6556-fwc2-fg2p: Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran._eval_length

Summary

Details

PoC

Impact

Credits

GHSA-6556-fwc2-fg2p:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

N/A

N/A

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

GHSA-6556-fwc2-fg2p: Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran._eval_length

Summary

Details

PoC

Impact

Credits

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI