Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran.getlincoef gadget in pickle __reduce__ methods, allowing arbitrary code execution. Attacker…

CVE-2025-71372 affects Picklescan versions before 0.0.33, a security tool designed to detect malicious pickle files. The vulnerability stems from Picklescan's failure to detect the numpy.f2py.crackfortran.getlincoef gadget used in pickle __reduce__ methods. Attackers can craft malicious pickle files that execute arbitrary Python code upon loading, effectively bypassing Picklescan's safety checks. This flaw poses a significant supply-chain risk, as shared machine learning model files distributed in pickle format could be poisoned. The attack vector is particularly dangerous in AI/ML ecosystems where model sharing is common. A fix was introduced in Picklescan version 0.0.33. Users and organizations relying on Picklescan for model security validation should update immediately. The vulnerability has been publicly disclosed with supporting advisories from GitHub and VulnCheck.