Read the docs
TI-2025-09324 Aliases CVE-2025-10157GHSA-f7qq-56ww-84cr

PickleScan Bypasses Unsafe Globals Check Using Submodule Imports

Priority HIGH 73CWE-693Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-693.

Summary

A Protection Mechanism Failure vulnerability in mmaitre314 picklescan versions up to and including 0.0.30 allows a remote attacker to bypass the unsafe globals check. This is possible because the scanner performs an exact match for module names, allowing malicious payloads to be loaded via submodules of dangerous packages (e.g., 'asyncio.unix_events' instead of 'asyncio'). When the incorrectly considered safe file is loaded after scan, it can lead to the execution of malicious code.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00789 56th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA and NVD
Fix Fixed picklescan (PyPI): 0.0.31

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
picklescanpicklescanup to 0.0.30—No fix listedCNA
—picklescan (PyPI)before 0.0.310.0.31Patch availableGHSA-f7qq-56ww-84cr
  • picklescan Vendorpicklescan Affected up to 0.0.30 Fixed in — No fix listed CNA
  • picklescan (PyPI) Vendor— Affected before 0.0.31 Fixed in 0.0.31 Patch available GHSA-f7qq-56ww-84cr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mmaitre314:picklescan:*:*:*:*:*:*:*:*before 0.0.31Vulnerablepicklescan
  • cpe:2.3:a:mmaitre314:picklescan:*:*:*:*:*:*:*:* Versions before 0.0.31 Vulnerable ·picklescan

Remediation

  • Fix · GHSA-f7qq-56ww-84cr picklescan (PyPI) Fixed in 0.0.31 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-10157
  2. 2026-10-03 Alias added: GHSA-f7qq-56ww-84cr

References

Exploit 2

Advisory 1

Other 5

  • TI-2025-09323 PickleScan Security Bypass via Bad CRC in ZIP Archive CVSS 4.0CRITICAL 9.3
  • TI-2025-09322 PickleScan Security Bypass Using Misleading File Extension CVSS 4.0CRITICAL 9.3
  • TI-2026-40669 picklescan - Arbitrary File Creation via logging.FileHandler Deserialization CVSS 4.0MEDIUM 6.9
  • TI-2025-43498 picklescan - Remote Code Execution via Undetected cProfile.runctx in Pickle Files CVSS 4.0HIGH 7.6
  • TI-2025-43477 picklescan - Arbitrary Code Execution via Undetected idlelib.pyshell.ModifiedInterpreter.runcommand CVSS 4.0HIGH 7.6
  • TI-2025-43468 picklescan - Arbitrary Code Execution via torch.utils._config_module.load_config Bypass CVSS 4.0HIGH 7.6
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences