High severity7.8NVD Advisory· Published Sep 17, 2025· Updated Sep 26, 2026
CVE-2025-10155
CVE-2025-10155
Description
An Improper Input Validation vulnerability in the scanning logic of mmaitre314 picklescan versions up to and including 0.0.30 allows a remote attacker to bypass pickle files security checks by supplying a standard pickle file with a PyTorch-related file extension. When the pickle file incorrectly considered safe is loaded, it can lead to the execution of malicious code.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
picklescanPyPI | < 0.0.31 | 0.0.31 |
Affected products
3cpe:2.3:a:mmaitre314:picklescan:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:mmaitre314:picklescan:*:*:*:*:*:*:*:*range: <0.0.31
- (no CPE)range: 0
Patches
Vulnerability mechanics
References
6- github.com/mmaitre314/picklescan/security/advisories/GHSA-jgw4-cr84-mqxgnvdExploitPatchVendor AdvisoryWEB
- github.com/advisories/GHSA-jgw4-cr84-mqxgghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-10155ghsaADVISORY
- github.com/mmaitre314/picklescan/blob/58983e1c20973ac42f2df7ff15d7c8cd32f9b688/src/picklescan/scanner.pynvdProductWEB
- github.com/mmaitre314/picklescan/commit/28a7b4ef753466572bda3313737116eeb9b4e5c5ghsaWEB
- github.com/pypa/advisory-database/tree/main/vulns/picklescan/PYSEC-2025-151.yamlghsaWEB
News mentions
0No linked articles in our index yet.