picklescan - Security scanning bypass via 'pip main'
picklescan before 0.0.21 does not treat 'pip' as an unsafe global. An attacker could craft a malicious model that uses Pickle to pull in a malicious PyPI package (hosted, for example, on pypi.org or GitHub) via `pip.main()`. Because pip is not a restricted global, the model, when scanned with picklescan, would pass security checks and appear to be safe, when it could instead prove to be problematic.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-1889US | critical9.8 | — | ||
picklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. An attacker could craft a malicious model that uses Pickle and incl… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/1xxx/CVE-2025-1716.jsonADVISORY
- https://github.com/mmaitre314/picklescanPACKAGE
- https://github.com/mmaitre314/picklescan/commit/78ce704227c51f070c0c5fb4b466d92c62a7aa3dFIX
- https://github.com/mmaitre314/picklescan/security/advisories/GHSA-655q-fx9r-782vADVISORY
- https://nvd.nist.gov/vuln/detail/CVE-2025-1716ADVISORY
- https://pypi.org/project/picklescan/PACKAGE
- https://www.sonatype.com/security-advisories/cve-2025-1716ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan