https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 09:19:10 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-15287 bdu:2025-15287 https://cve.radiocsirt.org/vuln/bdu:2025-15287 https://cve.radiocsirt.org/vuln/euvd-2026-252848 EUVD-2026-252848 https://cve.radiocsirt.org/vuln/euvd-2026-252848 https://cve.radiocsirt.org/vuln/fkie_cve-2025-10155 <p>An Improper Input Validation vulnerability in the scanning logic of mmaitre314 picklescan versions up to and including 0.0.30 allows a remote attacker to bypass pickle files security checks by supplying a standard pickle file with a PyTorch-related file extension. When the pickle file incorrectly considered safe is loaded, it can lead to the execution of malicious code.</p> <p>An Improper Input Validation vulnerability in the scanning logic of mmaitre314 picklescan versions up to and including 0.0.30 allows a remote attacker to bypass pickle files security checks by supplying a standard pickle file with a PyTorch-related file extension. When the pickle file incorrectly considered safe is loaded, it can lead to the execution of malicious code.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-10155 https://cve.radiocsirt.org/vuln/ghsa-jgw4-cr84-mqxg <p><strong>Affected:</strong> PyPI: picklescan</p> <p>### Summary Picklescan can be bypassed, allowing the detection of malicious pickle files to fail, when a standard pickle file is given a PyTorch-related file extension (e.g., .bin). This occurs because the scanner prioritizes PyTorch file extension checks and errors out when parsing a standard pickle file with such an extension instead of falling back to standard pickle analysis. This vulnerability allows attackers to disguise malicious pickle payloads within files that would otherwise be scanned for pickle-based threats. ### Details The vulnerability stems from the logic in the scan_bytes function within picklescan/scanner.py, specifically around line 463:[ https://github.com/mmaitre314/picklescan/blob/75e60f2c02f3f1a029362e6f334e1921392dcf60/src/picklescan/scanner.py#L463](https://github.com/mmaitre314/picklescan/blob/75e60f2c02f3f1a029362e6f334e1921392dcf60/src/picklescan/scanner.py#L463) The code first checks if the file extension (file_ext) is in the pytorch_file_extension list. If it is (e.g., .bin), the scan_pytorch function is called. When a standard pickle file is encountered with a PyTorch extension, scan_pytorch will likely fail. Critically, the code then returns an Error without attempting to analyze the file as a standard pickle using scan_pickle_bytes. This prevents the detection of malicious payloads within such files. ### PoC - Download a malicious pickle file with a standard .pkl extension: wget &lt;https://huggingface.co/kzanki/regular_model/resolve/main/model…</p> <p><strong>Affected:</strong> PyPI: picklescan</p> <p>### Summary Picklescan can be bypassed, allowing the detection of malicious pickle files to fail, when a standard pickle file is given a PyTorch-related file extension (e.g., .bin). This occurs because the scanner prioritizes PyTorch file extension checks and errors out when parsing a standard pickle file with such an extension instead of falling back to standard pickle analysis. This vulnerability allows attackers to disguise malicious pickle payloads within files that would otherwise be scanned for pickle-based threats. ### Details The vulnerability stems from the logic in the scan_bytes function within picklescan/scanner.py, specifically around line 463:[ https://github.com/mmaitre314/picklescan/blob/75e60f2c02f3f1a029362e6f334e1921392dcf60/src/picklescan/scanner.py#L463](https://github.com/mmaitre314/picklescan/blob/75e60f2c02f3f1a029362e6f334e1921392dcf60/src/picklescan/scanner.py#L463) The code first checks if the file extension (file_ext) is in the pytorch_file_extension list. If it is (e.g., .bin), the scan_pytorch function is called. When a standard pickle file is encountered with a PyTorch extension, scan_pytorch will likely fail. Critically, the code then returns an Error without attempting to analyze the file as a standard pickle using scan_pickle_bytes. This prevents the detection of malicious payloads within such files. ### PoC - Download a malicious pickle file with a standard .pkl extension: wget &lt;https://huggingface.co/kzanki/regular_model/resolve/main/model…</p> https://cve.radiocsirt.org/vuln/ghsa-jgw4-cr84-mqxg https://cve.radiocsirt.org/vuln/pysec-2025-151 <p><strong>Affected:</strong> PyPI: picklescan</p> <p>An Improper Input Validation vulnerability in the scanning logic of mmaitre314 picklescan versions up to and including 0.0.30 allows a remote attacker to bypass pickle files security checks by supplying a standard pickle file with a PyTorch-related file extension. When the pickle file incorrectly considered safe is loaded, it can lead to the execution of malicious code.</p> <p><strong>Affected:</strong> PyPI: picklescan</p> <p>An Improper Input Validation vulnerability in the scanning logic of mmaitre314 picklescan versions up to and including 0.0.30 allows a remote attacker to bypass pickle files security checks by supplying a standard pickle file with a PyTorch-related file extension. When the pickle file incorrectly considered safe is loaded, it can lead to the execution of malicious code.</p> https://cve.radiocsirt.org/vuln/pysec-2025-151