GHSA-R8G5-CGF2-4M4M

An unsafe deserialization vulnerability allows an attacker to execute arbitrary code on the host when loading a malicious pickle payload from an untrusted source.

Details

The numpy.f2py.crackfortran module exposes many functions that call eval on arbitrary strings of values. This is the case for getlincoef and _eval_length. This list is probably not exhaustive.

According to https://numpy.org/doc/stable/reference/security.html#advice-for-using-numpy-on-untrusted-data, the whole numpy.f2py should be considered unsafe when loading a pickle.

PoC

from numpy.f2py.crackfortran import getlincoef

class EvilClass:
    def __reduce__(self):
        payload = "__import__('os').system('echo \"successful attack\"')"
        return getlincoef, (payload, [])

Note

The problem was originally reported to the joblib project, but this was deemed unrelated to joblib itself. However, I checked that picklescan was indeed vulnerable.

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files from untrusted sources.
What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.
Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

Untrusted serialized data is processed by a deserializer that can instantiate arbitrary objects or execute code as a side effect. Typical impact: arbitrary code execution or logic abuse.

Kodem intelligence

1. What is GHSA-R8G5-CGF2-4M4M? GHSA-R8G5-CGF2-4M4M is a high-severity insecure deserialization vulnerability in picklescan (pip), affecting versions < 0.0.33. It is fixed in 0.0.33. Untrusted serialized data is processed by a deserializer that can instantiate arbitrary objects or execute code as a side effect.
2. Which versions of picklescan are affected by GHSA-R8G5-CGF2-4M4M? picklescan (pip) versions < 0.0.33 is affected.
3. Is there a fix for GHSA-R8G5-CGF2-4M4M? Yes. GHSA-R8G5-CGF2-4M4M is fixed in 0.0.33. Upgrade to this version or later.
4. Is GHSA-R8G5-CGF2-4M4M exploitable, and should I be worried? Whether GHSA-R8G5-CGF2-4M4M is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether GHSA-R8G5-CGF2-4M4M is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix GHSA-R8G5-CGF2-4M4M? Upgrade picklescan to 0.0.33 or later.