Vulnerability · Published Feb 26, 2025 · Assigned by Sonatype
CVE-2025-1716picklescan - Security scanning bypass via 'pip main'
Medium 5.3
In plain English
A medium-severity security flaw in picklescan from mmaitre314. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 78% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
picklescan before 0.0.21 does not treat 'pip' as an unsafe global. An attacker could craft a malicious model that uses Pickle to pull in a malicious PyPI package (hosted, for example, on pypi.org or GitHub) via `pip.main()`. Because pip is not a restricted global, the model, when scanned with picklescan, would pass security checks and appear to be safe, when it could instead prove to be problematic.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | picklescan | 0.0.22 | GHSA-655q-fx9r-782v |
| PyPI | picklescan | 0.0.22 | GHSA-769v-p64c-89pr |
| PyPI | picklescan | 0.0.21 | PYSEC-2025-18 |
| PyPI | picklescan | 0.0.22 | PYSEC-2025-19 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| mmaitre314 | picklescan | 0.0.1 – through 0.0.20 |
Weakness: CWE-184 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N