CVE-2025-71365: picklescan - Arbitrary Code Execution via numpy.f2py.crackfortran.myeval Detection Bypass
Published Jun 23, 2026
·Updated
picklescan before 0.0.33 fails to detect malicious pickle files that invoke numpy.f2py.crackfortran.myeval function through the reduce method. Attackers can craft malicious pickle files embedding arbitrary code that evades picklescan detection and executes remote code when loaded.
Affected Software
1 affected component
pypi/picklescan<0.0.33
Event History
Jun 23, 2026
CVE Published
via MITRE·12:12 PM
Data Sourced
via MITRE·12:12 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-71365?
The severity of CVE-2025-71365 is rated high with a score of 8.1.
2
How do I fix CVE-2025-71365?
To fix CVE-2025-71365, upgrade picklescan to version 0.0.33 or later.
3
What are the potential risks associated with CVE-2025-71365?
CVE-2025-71365 allows attackers to execute arbitrary code through malicious pickle files.
4
Which software is affected by CVE-2025-71365?
CVE-2025-71365 affects picklescan versions prior to 0.0.33.
5
What kind of attack is possible with CVE-2025-71365?
CVE-2025-71365 enables remote code execution via detection bypass of malicious pickle files.