CVE-2025-1716GHSA-655Q-FX9R-782VGHSA-769V-P64C-89PRPYSEC-2025-18PYSEC-2025-19
picklescan - Security scanning bypass via 'pip main'
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.0.22, 0.0.21
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 2 proofs of concept on GitHub
CISA's decision points: whether it is exploited, whether attacks can be automated, and how much control an attacker gets. Assessed (SSVC 2.0.3).What do these mean? →
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
picklescan before 0.0.21 does not treat 'pip' as an unsafe global. An attacker could craft a malicious model that uses Pickle to pull in a malicious PyPI package (hosted, for example, on pypi.org or GitHub) via `pip.main()`. Because pip is not a restricted global, the model, when scanned with picklescan, would pass security checks and appear to be safe, when it could instead prove to be problematic.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- mmaitre314 picklescan
From 0.0.1 · through 0.0.20
- picklescanPyPI
fixed in 0.0.22
- picklescanPyPI
fixed in 0.0.21