CVE-2025-10157

A Protection Mechanism Failure vulnerability in mmaitre314 picklescan versions up to and including 0.0.30 allows a remote attacker to bypass the unsafe globals check. This is possible because the scanner performs an exact match for module names, allowing malicious payloads to be loaded via submodules of dangerous packages (e.g., 'asyncio.unix_events' instead of 'asyncio'). When the incorrectly considered safe file is loaded after scan, it can lead to the execution of malicious code.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/mmaitre314/picklescan/blob/2a8383cfeb4158567f9770d86597300c9e508d0f/src/picklescan/scanner.py#L309	Product
https://github.com/mmaitre314/picklescan/security/advisories/GHSA-f7qq-56ww-84cr	Exploit Vendor Advisory
https://huggingface.co/iluem/linux_pkl/resolve/main/asyncio_asyncio_unix_events___UnixSubprocessTransport__start.pkl	Broken Link

Configurations

Configuration 1 (hide)

cpe:2.3:a:mmaitre314:picklescan:*:*:*:*:*:*:*:*

History

26 Sep 2026, 00:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de fallo en el mecanismo de protección en las versiones de mmaitre314 picklescan hasta la 0.0.30 inclusive permite a un atacante remoto eludir la comprobación de globales inseguras. Esto es posible porque el escáner realiza una coincidencia exacta para los nombres de los módulos, permitiendo que se carguen cargas útiles maliciosas a través de submódulos de paquetes peligrosos (por ejemplo, 'asyncio.unix_events' en lugar de 'asyncio'). Cuando el archivo incorrectamente considerado seguro se carga después del escaneo, puede conducir a la ejecución de código malicioso.

Information

Published : 2025-09-17 12:15

Updated : 2026-09-26 00:10

NVD link : CVE-2025-10157

Mitre link : CVE-2025-10157

CVE.ORG link : CVE-2025-10157

JSON object : View

Products Affected

mmaitre314

picklescan

CWE

CWE-693

Protection Mechanism Failure

{"id": "CVE-2025-10157", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10157", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-17T13:07:29.343961Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "reefs@jfrog.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "reefs@jfrog.com", "affectedData": [{"vendor": "mmaitre314", "product": "picklescan", "versions": [{"status": "affected", "changes": [{"at": "0.0.31", "status": "unaffected"}], "version": "0", "versionType": "semver", "lessThanOrEqual": "0.0.30"}], "defaultStatus": "unaffected"}]}], "published": "2025-09-17T12:15:38.097", "references": [{"url": "https://github.com/mmaitre314/picklescan/blob/2a8383cfeb4158567f9770d86597300c9e508d0f/src/picklescan/scanner.py#L309", "tags": ["Product"], "source": "reefs@jfrog.com"}, {"url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-f7qq-56ww-84cr", "tags": ["Exploit", "Vendor Advisory"], "source": "reefs@jfrog.com"}, {"url": "https://huggingface.co/iluem/linux_pkl/resolve/main/asyncio_asyncio_unix_events___UnixSubprocessTransport__start.pkl", "tags": ["Broken Link"], "source": "reefs@jfrog.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "reefs@jfrog.com", "description": [{"lang": "en", "value": "CWE-693"}]}], "descriptions": [{"lang": "en", "value": "A Protection Mechanism Failure vulnerability in mmaitre314 picklescan versions up to and including 0.0.30 allows a remote attacker to bypass the unsafe globals check. This is possible because the scanner performs an exact match for module names, allowing malicious payloads to be loaded via submodules of dangerous packages (e.g., 'asyncio.unix_events' instead of 'asyncio'). \n\nWhen the incorrectly considered safe file is loaded after scan, it can lead to the execution of malicious code."}, {"lang": "es", "value": "Una vulnerabilidad de fallo en el mecanismo de protecci\u00f3n en las versiones de mmaitre314 picklescan hasta la 0.0.30 inclusive permite a un atacante remoto eludir la comprobaci\u00f3n de globales inseguras. Esto es posible porque el esc\u00e1ner realiza una coincidencia exacta para los nombres de los m\u00f3dulos, permitiendo que se carguen cargas \u00fatiles maliciosas a trav\u00e9s de subm\u00f3dulos de paquetes peligrosos (por ejemplo, 'asyncio.unix_events' en lugar de 'asyncio'). Cuando el archivo incorrectamente considerado seguro se carga despu\u00e9s del escaneo, puede conducir a la ejecuci\u00f3n de c\u00f3digo malicioso."}], "lastModified": "2026-09-26T00:10:00.127", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mmaitre314:picklescan:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C1ABB08D-CB91-4CA6-9EA3-A77D8B8484E0", "versionEndExcluding": "0.0.31"}], "operator": "OR"}]}], "sourceIdentifier": "reefs@jfrog.com"}