cvelistv5 - cve-2025-1945

cve-2025-1945

Vulnerability from cvelistv5

Published

2025-03-10 11:43

Modified

2025-03-10 12:05

Severity ?

5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L

Summary

picklescan - Zip Flag Bit Exploit Crashes Picklescan But Not PyTorch

References

URL	Tags
103e4ec9-0a87-450b-af77-479448ddef11	https://github.com/mmaitre314/picklescan/commit/e58e45e0d9e091159c1554f9b04828bbb40b9781	Patch
103e4ec9-0a87-450b-af77-479448ddef11	https://github.com/mmaitre314/picklescan/security/advisories/GHSA-w8jq-xcqf-f792	Exploit, Vendor Advisory
103e4ec9-0a87-450b-af77-479448ddef11	https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-1945	Exploit, Third Party Advisory

Impacted products

▼	Vendor	Product
	mmaitre314	picklescan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-1945",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-10T12:04:32.561800Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-10T12:05:04.004Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "picklescan",
          "vendor": "mmaitre314",
          "versions": [
            {
              "lessThan": "0.0.23",
              "status": "affected",
              "version": "0.0.1",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Trevor Madge (@madgetr) of Sonatype"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "picklescan before 0.0.23 fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag bits are modified. By flipping specific bits in the ZIP file headers, an attacker can embed malicious pickle files that remain undetected by PickleScan while still being successfully loaded by PyTorch\u0027s torch.load(). This can lead to arbitrary code execution when loading a compromised model."
            }
          ],
          "value": "picklescan before 0.0.23 fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag bits are modified. By flipping specific bits in the ZIP file headers, an attacker can embed malicious pickle files that remain undetected by PickleScan while still being successfully loaded by PyTorch\u0027s torch.load(). This can lead to arbitrary code execution when loading a compromised model."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-345",
              "description": "CWE-345 Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-10T11:43:02.158Z",
        "orgId": "103e4ec9-0a87-450b-af77-479448ddef11",
        "shortName": "Sonatype"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-1945"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-w8jq-xcqf-f792"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/mmaitre314/picklescan/commit/e58e45e0d9e091159c1554f9b04828bbb40b9781"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "picklescan - Zip Flag Bit Exploit Crashes Picklescan But Not PyTorch",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "103e4ec9-0a87-450b-af77-479448ddef11",
    "assignerShortName": "Sonatype",
    "cveId": "CVE-2025-1945",
    "datePublished": "2025-03-10T11:43:02.158Z",
    "dateReserved": "2025-03-04T12:59:35.306Z",
    "dateUpdated": "2025-03-10T12:05:04.004Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-1945\",\"sourceIdentifier\":\"103e4ec9-0a87-450b-af77-479448ddef11\",\"published\":\"2025-03-10T12:15:12.450\",\"lastModified\":\"2025-03-19T16:14:37.237\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"picklescan before 0.0.23 fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag bits are modified. By flipping specific bits in the ZIP file headers, an attacker can embed malicious pickle files that remain undetected by PickleScan while still being successfully loaded by PyTorch\u0027s torch.load(). This can lead to arbitrary code execution when loading a compromised model.\"},{\"lang\":\"es\",\"value\":\"Las versiones anteriores a la versi\u00f3n 0.0.23 de picklescan no detectan archivos pickle maliciosos dentro de los archivos de modelos de PyTorch cuando se modifican ciertos bits de indicadores de archivos ZIP. Al invertir bits espec\u00edficos en los encabezados de archivos ZIP, un atacante puede incrustar archivos pickle maliciosos que PickleScan no detecta, pero que se cargan correctamente con la funci\u00f3n Torch.load() de PyTorch. Esto puede provocar la ejecuci\u00f3n de c\u00f3digo arbitrario al cargar un modelo comprometido.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"103e4ec9-0a87-450b-af77-479448ddef11\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"PASSIVE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"LOW\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"LOW\",\"subAvailabilityImpact\":\"LOW\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"103e4ec9-0a87-450b-af77-479448ddef11\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-345\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mmaitre314:picklescan:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"0.0.23\",\"matchCriteriaId\":\"B21661AE-0228-49C7-A966-4FDA8DAF0C0B\"}]}]}],\"references\":[{\"url\":\"https://github.com/mmaitre314/picklescan/commit/e58e45e0d9e091159c1554f9b04828bbb40b9781\",\"source\":\"103e4ec9-0a87-450b-af77-479448ddef11\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/mmaitre314/picklescan/security/advisories/GHSA-w8jq-xcqf-f792\",\"source\":\"103e4ec9-0a87-450b-af77-479448ddef11\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-1945\",\"source\":\"103e4ec9-0a87-450b-af77-479448ddef11\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]}]}}"
  }
}

ghsa-w8jq-xcqf-f792

Vulnerability from github

Published

2025-03-10 18:26

Modified

2025-04-09 20:13

Severity ?

5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Summary

Zip Flag Bit Exploit Crashes Picklescan But Not PyTorch

Details

Summary

PickleScan fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag bits are modified. By flipping specific bits in the ZIP file headers, an attacker can embed malicious pickle files that remain undetected by PickleScan while still being successfully loaded by PyTorch's torch.load(). This can lead to arbitrary code execution when loading a compromised model.

Details

PickleScan relies on Python’s zipfile module to extract and scan files within ZIP-based model archives. However, certain flag bits in ZIP headers affect how files are interpreted, and some of these bits cause PickleScan to fail while leaving PyTorch’s loading mechanism unaffected.

By modifying the flag_bits field in the ZIP file entry, an attacker can:

Embed a malicious pickle file (bad_file.pkl) in a PyTorch model archive.
Flip specific bits (e.g., 0x1, 0x20, 0x40) in the ZIP metadata.
Prevent PickleScan from scanning the archive due to errors raised by zipfile.
Successfully load the model with torch.load(), which ignores the flag modifications.

This technique effectively bypasses PickleScan's security checks while maintaining model functionality.

PoC

``` import os import zipfile import torch from picklescan import cli

def can_scan(zip_file): try: cli.print_summary(False, cli.scan_file_path(zip_file)) return True except Exception: return False

bit_to_flip = 0x1 # Change to 0x20 or 0x40 to test different flag bits

zip_file = "model.pth" model = {'a': 1, 'b': 2, 'c': 3} torch.save(model, zip_file)

with zipfile.ZipFile(zip_file, "r") as source: flipped_name = f"flipped_{bit_to_flip}_{zip_file}" with zipfile.ZipFile(flipped_name, "w") as dest: bad_file = zipfile.ZipInfo("model/bad_file.pkl")

    # Modify the ZIP flag bits
    bad_file.flag_bits |= bit_to_flip

    dest.writestr(bad_file, b"bad content")
    for item in source.infolist():
        dest.writestr(item, source.read(item.filename))

if model == torch.load(flipped_name, weights_only=False): if not can_scan(flipped_name): print('Found exploitable bit:', bit_to_flip) else: os.remove(flipped_name) ```

Impact

Severity: High

Who is impacted? Any organization or user relying on PickleScan to detect malicious pickle files inside PyTorch models.
What is the impact? Attackers can embed malicious pickle payloads inside PyTorch models that evade PickleScan's detection but still execute upon loading.
Potential Exploits: This vulnerability could be exploited in machine learning supply chain attacks, allowing attackers to distribute backdoored models on platforms like Hugging Face or PyTorch Hub.

Recommendations

Improve ZIP Handling: PickleScan should use a more relaxed ZIP parser marches on when encountering modified flag bits.
Scan All Embedded Files Regardless of Flags: Ensure that files with altered metadata are still extracted and analyzed.

By addressing these issues, PickleScan can provide stronger protection against manipulated PyTorch model archives.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "picklescan"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.23"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-1945"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-345"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-10T18:26:35Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nPickleScan fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag bits are modified. By flipping specific bits in the ZIP file headers, an attacker can embed malicious pickle files that remain undetected by PickleScan while still being successfully loaded by PyTorch\u0027s torch.load(). This can lead to arbitrary code execution when loading a compromised model.\n\n### Details\n\nPickleScan relies on Python\u2019s zipfile module to extract and scan files within ZIP-based model archives. However, certain flag bits in ZIP headers affect how files are interpreted, and some of these bits cause PickleScan to fail while leaving PyTorch\u2019s loading mechanism unaffected.\n\nBy modifying the flag_bits field in the ZIP file entry, an attacker can:\n\n- Embed a malicious pickle file (bad_file.pkl) in a PyTorch model archive.\n- Flip specific bits (e.g., 0x1, 0x20, 0x40) in the ZIP metadata.\n- Prevent PickleScan from scanning the archive due to errors raised by zipfile.\n- Successfully load the model with torch.load(), which ignores the flag modifications.\n\nThis technique effectively bypasses PickleScan\u0027s security checks while maintaining model functionality.\n\n### PoC\n```\nimport os\nimport zipfile\nimport torch\nfrom picklescan import cli\n\ndef can_scan(zip_file):\n    try:\n        cli.print_summary(False, cli.scan_file_path(zip_file))\n        return True\n    except Exception:\n        return False\n\nbit_to_flip = 0x1  # Change to 0x20 or 0x40 to test different flag bits\n\nzip_file = \"model.pth\"\nmodel = {\u0027a\u0027: 1, \u0027b\u0027: 2, \u0027c\u0027: 3}\ntorch.save(model, zip_file)\n\nwith zipfile.ZipFile(zip_file, \"r\") as source:\n    flipped_name = f\"flipped_{bit_to_flip}_{zip_file}\"\n    with zipfile.ZipFile(flipped_name, \"w\") as dest:\n        bad_file = zipfile.ZipInfo(\"model/bad_file.pkl\")\n        \n        # Modify the ZIP flag bits\n        bad_file.flag_bits |= bit_to_flip\n        \n        dest.writestr(bad_file, b\"bad content\")\n        for item in source.infolist():\n            dest.writestr(item, source.read(item.filename))\n\nif model == torch.load(flipped_name, weights_only=False):\n    if not can_scan(flipped_name):\n        print(\u0027Found exploitable bit:\u0027, bit_to_flip)\nelse:\n    os.remove(flipped_name)\n```\n\n### Impact\n\nSeverity: `High`\n\n- Who is impacted? Any organization or user relying on PickleScan to detect malicious pickle files inside PyTorch models.\n- What is the impact? Attackers can embed malicious pickle payloads inside PyTorch models that evade PickleScan\u0027s detection but still execute upon loading.\n- Potential Exploits: This vulnerability could be exploited in machine learning supply chain attacks, allowing attackers to distribute backdoored models on platforms like Hugging Face or PyTorch Hub.\n\n### Recommendations\n\n- Improve ZIP Handling: PickleScan should use a more relaxed ZIP parser marches on when encountering modified flag bits.\n- Scan All Embedded Files Regardless of Flags: Ensure that files with altered metadata are still extracted and analyzed.\n\nBy addressing these issues, PickleScan can provide stronger protection against manipulated PyTorch model archives.",
  "id": "GHSA-w8jq-xcqf-f792",
  "modified": "2025-04-09T20:13:19Z",
  "published": "2025-03-10T18:26:35Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-w8jq-xcqf-f792"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1945"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mmaitre314/picklescan/commit/e58e45e0d9e091159c1554f9b04828bbb40b9781"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mmaitre314/picklescan"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/picklescan/PYSEC-2025-21.yaml"
    },
    {
      "type": "WEB",
      "url": "https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-1945"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Zip Flag Bit Exploit Crashes Picklescan But Not PyTorch"
}

ghsa-2fh4-gpch-vqv4

Vulnerability from github

Published

2025-03-10 12:30

Modified

2025-03-10 18:31

Severity ?

5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L

Summary

Duplicate Advisory: Zip Flag Bit Exploit Crashes Picklescan But Not PyTorch

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-w8jq-xcqf-f792. This link is maintained to preserve external references.

Original Description

picklescan before 0.0.23 fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag bits are modified. By flipping specific bits in the ZIP file headers, an attacker can embed malicious pickle files that remain undetected by PickleScan while still being successfully loaded by PyTorch's torch.load(). This can lead to arbitrary code execution when loading a compromised model.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "picklescan"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.23"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-345"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-10T18:26:09Z",
    "nvd_published_at": "2025-03-10T12:15:12Z",
    "severity": "MODERATE"
  },
  "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-w8jq-xcqf-f792. This link is maintained to preserve external references.\n\n## Original Description\npicklescan before 0.0.23 fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag bits are modified. By flipping specific bits in the ZIP file headers, an attacker can embed malicious pickle files that remain undetected by PickleScan while still being successfully loaded by PyTorch\u0027s torch.load(). This can lead to arbitrary code execution when loading a compromised model.",
  "id": "GHSA-2fh4-gpch-vqv4",
  "modified": "2025-03-10T18:31:03Z",
  "published": "2025-03-10T12:30:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-w8jq-xcqf-f792"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1945"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mmaitre314/picklescan/commit/e58e45e0d9e091159c1554f9b04828bbb40b9781"
    },
    {
      "type": "WEB",
      "url": "https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-1945"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Duplicate Advisory: Zip Flag Bit Exploit Crashes Picklescan But Not PyTorch",
  "withdrawn": "2025-03-10T18:26:09Z"
}

pysec-2025-21

Vulnerability from pysec

Published

2025-03-10 12:15

Modified

2025-04-09 17:27

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "picklescan",
        "purl": "pkg:pypi/picklescan"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "e58e45e0d9e091159c1554f9b04828bbb40b9781"
            }
          ],
          "repo": "https://github.com/mmaitre314/picklescan",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.23"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.0.1",
        "0.0.10",
        "0.0.11",
        "0.0.12",
        "0.0.13",
        "0.0.14",
        "0.0.15",
        "0.0.16",
        "0.0.17",
        "0.0.18",
        "0.0.19",
        "0.0.2",
        "0.0.20",
        "0.0.21",
        "0.0.22",
        "0.0.3",
        "0.0.4",
        "0.0.5",
        "0.0.6",
        "0.0.7",
        "0.0.8",
        "0.0.9"
      ]
    }
  ],
  "aliases": [
    "CVE-2025-1945",
    "GHSA-w8jq-xcqf-f792"
  ],
  "details": "picklescan before 0.0.23 fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag bits are modified. By flipping specific bits in the ZIP file headers, an attacker can embed malicious pickle files that remain undetected by PickleScan while still being successfully loaded by PyTorch\u0027s torch.load(). This can lead to arbitrary code execution when loading a compromised model.",
  "id": "PYSEC-2025-21",
  "modified": "2025-04-09T17:27:27.016747+00:00",
  "published": "2025-03-10T12:15:12+00:00",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-w8jq-xcqf-f792"
    },
    {
      "type": "EVIDENCE",
      "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-w8jq-xcqf-f792"
    },
    {
      "type": "EVIDENCE",
      "url": "https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-1945"
    },
    {
      "type": "FIX",
      "url": "https://github.com/mmaitre314/picklescan/commit/e58e45e0d9e091159c1554f9b04828bbb40b9781"
    },
    {
      "type": "WEB",
      "url": "https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-1945"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Action not permitted

cve-2025-1945

Vulnerability from cvelistv5

ghsa-w8jq-xcqf-f792

Vulnerability from github

Summary

Details

PoC

Impact

Recommendations

ghsa-2fh4-gpch-vqv4

Vulnerability from github

Duplicate Advisory

Original Description

pysec-2025-21

Vulnerability from pysec

Tags