Picklescan uses the numpy.f2py.crackfortran._eval_length function as part of its unpickling process. However, it does not detect malicious pickles that use this function in the __reduce__ method to execute arbitrary code. An attacker can craft a pickle that returns this function with attacker-controlled arguments, causing code execution when pickle.load() is called, even though Picklescan incorrectly marks the file as safe. This vulnerability affects Picklescan versions before 0.0.33 and impacts any environment relying on Picklescan for untrusted pickle file scanning.

Successful exploitation results in arbitrary code execution on the victim machine when a malicious pickle file is loaded. This undermines the security of workflows that depend on Picklescan to validate pickle or PyTorch model files, potentially allowing attackers to perform supply-chain poisoning by distributing malicious model files that appear safe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid trusting Picklescan's results for untrusted pickle files, and consider alternative methods to validate or sandbox unpickling operations to prevent arbitrary code execution.