GHSA-cffc-mxrf-mhh4: picklescan: Code Injection enables RCE

### Summary Picklescan uses numpy.f2py.crackfortran.param_eval, which is a function in numpy to execute remote pickle files. ### Details The attack payload executes in the following steps: - First, the attacker crafts the payload by calling the numpy.f2py.crackfortran.param_eval function via reduce method. - Then, when the victim checks whether the pickle file is safe by using the Picklescan library and this library doesn't detect any dangerous functions, they decide to use pickle.load() on this malicious pickle file, thus leading to remote code execution. ### PoC ``` class RCE: def __reduce__(self): from numpy.f2py.crackfortran import param_eval return (param_eval,("os.system('ls')",None,None,None)) ``` ### Impact Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models. Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded. Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects. ### Report by Pinji Chen (cpj24@mails.tsinghua.edu.cn) from the NISL lab (https://netsec.ccert.edu.cn/about) at Tsinghua University, Guanheng Liu (coolwind326@gmail.com).

An adversary targets an organization's ML model supply chain. They craft a malicious PyTorch .pkl file using numpy.f2py.crackfortran.param_eval as the __reduce__ callable — a function not on picklescan's blocklist. The file is uploaded to a public model registry (e.g., HuggingFace Hub) as a legitimate-looking fine-tuned model. The victim organization's automated pipeline downloads and scans it with picklescan — scan returns clean. Trusting the result, the pipeline calls pickle.load() and the payload executes: a reverse shell, credential harvester, or persistent backdoor planted in the training environment. From there, the adversary pivots to exfiltrate proprietary training data or poison downstream model artifacts.