Vulnerability · Published Mar 10, 2025 · Assigned by Sonatype
CVE-2025-1944picklescan ZIP archive manipulation attack leads to crash
Medium 5.3
In plain English
A medium-severity insufficient verification of data authenticity in picklescan from mmaitre314. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
picklescan before 0.0.23 is vulnerable to a ZIP archive manipulation attack that causes it to crash when attempting to extract and scan PyTorch model archives. By modifying the filename in the ZIP header while keeping the original filename in the directory listing, an attacker can make PickleScan raise a BadZipFile error. However, PyTorch's more forgiving ZIP implementation still allows the model to be loaded, enabling malicious payloads to bypass detection.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | picklescan | 0.0.23 | GHSA-7q5r-7gvp-wc82 |
| PyPI | picklescan | 0.0.23 | PYSEC-2025-20 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| mmaitre314 | picklescan | 0.0.1 – before 0.0.23 |
Weakness: CWE-345 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L