What is GHSA-gf62-q6c8-6vxg?

GHSA-gf62-q6c8-6vxg is a security advisory published by GitHub Security Advisories with High severity. Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran.getlincoef gadget in pickle...

Which CVE IDs does GHSA-gf62-q6c8-6vxg cover?

GHSA-gf62-q6c8-6vxg covers the following CVE IDs: CVE-2025-71372. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gf62-q6c8-6vxg?

GHSA-gf62-q6c8-6vxg has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

GHSA-gf62-q6c8-6vxgHighCVSS 8.1

Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran.getlincoef gadget in pickle...

Vendor

GitHub Security Advisories

Published

July 4, 2026

Last Modified

July 4, 2026

🔗 CVE IDs covered (1)

CVE-2025-71372 →

📋 Description

Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran.getlincoef gadget in pickle reduce methods, allowing arbitrary code execution. Attackers can craft malicious pickle files that execute arbitrary Python code when loaded, bypassing Picklescan's safety checks and enabling supply-chain poisoning of shared model files.

🔗 References (4)

https://github.com/mmaitre314/picklescan/security/advisories/GHSA-rrxm-2pvv-m66x
https://nvd.nist.gov/vuln/detail/CVE-2025-71372
https://www.vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-numpy-f2py-crackfortran-getlincoef-gadget
https://github.com/advisories/GHSA-gf62-q6c8-6vxg