CVE-2025-1945

Critical

Description

picklescan before 0.0.23 fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag bits are modified. By flipping specific bits in the ZIP file headers, an attacker can embed malicious pickle files that remain undetected by PickleScan while still being successfully loaded by PyTorch's torch.load(). This can lead to arbitrary code execution when loading a compromised model.

SeverityCritical

CVSS9.8

Exploit probability—

ProductMmaitre314 Picklescan

PublishedMar 10, 2025

First seenMar 10, 2025

Weakness typeCWE-345CWE-345

How to fix

Update

mmaitre314 picklescan0.0.23 or later
picklescan0.0.23 or later

Patches

github.com/mmaitre314/picklescan/commit/e58e45e0d9e091159c1554f9b04828bbb40b9781

Vendor advisories

github.com/mmaitre314/picklescan/security/advisories/GHSA-w8jq-xcqf-f792

Affected products

Product	Affected versions	Fixed in
mmaitre314 picklescan	v < 0.0.23	0.0.23
picklescanPyPI	v < 0.0.23	0.0.23

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.