CVE-2025-71347: picklescan: numpy.f2py bypass lets malicious pickle evade scan

picklescan, a widely used static scanner meant to flag malicious pickle files before they're deserialized, fails to detect payloads that abuse numpy.f2py.crackfortran.param_eval inside a reduce() method, letting a crafted pickle sail through as "clean" and execute arbitrary code the moment it's loaded. This matters because picklescan is a trust boundary — teams and model hubs rely on it as the last line of defense before running pickle.load()/torch.load() on artifacts from outside their org, so a bypass doesn't just add a vulnerability, it silently defeats an existing control. The CVSS 8.1 (network, low complexity, no privileges) reflects real severity, but EPSS sits at 0.445% (top 64th percentile) with no CISA KEV listing, no public exploit, and no Nuclei template, so opportunistic mass exploitation isn't happening yet — this looks more like a researcher-disclosed logic gap than an active campaign. Action: upgrade picklescan to >=0.0.33 immediately in any CI/CD, model-hub, or ingestion pipeline that gates pickle deserialization on it, and treat picklescan clearance as advisory rather than a hard safety guarantee until then — pair it with sandboxed loading or migrate to safetensors where possible.

No confirmed active exploitation of CVE-2025-71347 has been reported, but organizations should still patch proactively.

1) Upgrade picklescan to >=0.0.33 across all environments that use it as a scanning gate (CI, model registries, ingestion services). 2) Do not treat scanner clearance as a sole control — add defense in depth: load untrusted pickle/model artifacts only inside a sandboxed, network-isolated, least-privilege process. 3) Where feasible, migrate model serialization to safetensors or other non-executable formats instead of pickle. 4) Run a secondary/complementary scanner (e.g., fickling) alongside picklescan for cross-validation until confidence in the patched picklescan is established. 5) Audit recent artifacts that were scanned by pre-0.0.33 picklescan and cleared for use — re-scan with the patched version before continued trust. 6) Add detection for anomalous numpy.f2py imports or crackfortran.param_eval references inside deserialized pickle opcodes as a monitoring signal.

This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines, AI supply chain / model hub ingestion, MLOps CI/CD pipelines.

CVE-2025-71347 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.45%.