ghsa-f7qq-56ww-84cr
Vulnerability from github
Published
2025-09-10 17:15
Modified
2025-09-18 12:51
Severity ?
8.3 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
9.3 (Critical) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Summary
Picklescan is Vulnerable to Unsafe Globals Check Bypass through Subclass Imports
Details

Summary

The vulnerability allows malicious actors to bypass PickleScan's unsafe globals check, leading to potential arbitrary code execution. The issue stems from PickleScan's strict check for full module names against its list of unsafe globals. By using subclasses of dangerous imports instead of the exact module names, attackers can circumvent the check and inject malicious payloads.

PoC

  1. Download a model that uses the asyncio package:

wget https://huggingface.co/iluem/linux_pkl/resolve/main/asyncio_asyncio_unix_events___UnixSubprocessTransport__start.pkl

  1. Check with PickleScan: picklescan -p asyncio_asyncio_unix_events___UnixSubprocessTransport__start.pkl -g

Expected Result:

PickleScan should identify all asyncio import as dangerous and flag the pickle file as malicious as asyncio is in _unsafe_globals dictionary.

Actual Result: Screenshot 2025-06-29 at 14 13 38

PickleScan marked the import as Suspicious, failing to identify it as a dangerous import.

Impact

Severity: High Affected Users: Any organization, like HuggingFace, or individual using PickleScan to analyze PyTorch models or other files distributed as ZIP archives for malicious pickle content. Impact Details: Attackers can craft malicious PyTorch models containing embedded pickle payloads, package them into ZIP archives, and bypass the PickleScan check by using subclasses of dangerous imports. This could lead to arbitrary code execution on the user's system when these malicious files are processed or loaded.

Recommendations:

Replace: https://github.com/mmaitre314/picklescan/blob/2a8383cfeb4158567f9770d86597300c9e508d0f/src/picklescan/scanner.py#L309C9-L309C54

unsafe_filter = _unsafe_globals.get(g.module)

by: ``` matched_key = None if imported_global.module: for key_in_globals in unsafe_globals.keys(): # Check if imported_global.module starts with the key_in_globals AND # (it's the first match OR this key is more specific than the previous match) # AND imported_global.module is exactly the key or imported_global.module is key + '.' + something if imported_global.module.startswith(key_in_globals): if (imported_global.module == key_in_globals or # Exact match (len(imported_global.module) > len(key_in_globals) and imported_global.module[len(key_in_globals)] == '.')): # Submodule match if matched_key is None or len(key_in_globals) > len(matched_key): matched_key = key_in_globals

    if matched_key:
        unsafe_filter = unsafe_globals[matched_key]

```

Show details on source website

To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.0.30"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "picklescan"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.31"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-10157"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-693"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-09-10T17:15:33Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Summary\nThe vulnerability allows malicious actors to bypass PickleScan\u0027s unsafe globals check, leading to potential arbitrary code execution. The issue stems from PickleScan\u0027s strict check for full module names against its list of unsafe globals. By using subclasses of dangerous imports instead of the exact module names, attackers can circumvent the check and inject malicious payloads.\n\n### PoC\n1. Download a model that uses the `asyncio` package: \n\n```wget https://huggingface.co/iluem/linux_pkl/resolve/main/asyncio_asyncio_unix_events___UnixSubprocessTransport__start.pkl```\n\n2. Check with PickleScan: `picklescan -p asyncio_asyncio_unix_events___UnixSubprocessTransport__start.pkl -g`\n\n**Expected Result:**\n\nPickleScan should identify all `asyncio` import as dangerous and flag the pickle file as malicious as `asyncio` is in `_unsafe_globals` dictionary.\n\n**Actual Result:**\n![Screenshot 2025-06-29 at 14 13 38](https://github.com/user-attachments/assets/39467f50-5cdb-4c25-bb37-35c03dc4a626)\n\nPickleScan marked the import as Suspicious, failing to identify it as a dangerous import.\n\n### Impact\n**Severity**: High\n**Affected Users**: Any organization, like HuggingFace, or individual using PickleScan to analyze PyTorch models or other files distributed as ZIP archives for malicious pickle content.\n**Impact Details**: Attackers can craft malicious PyTorch models containing embedded pickle payloads, package them into ZIP archives, and bypass the PickleScan check by using subclasses of dangerous imports. This could lead to arbitrary code execution on the user\u0027s system when these malicious files are processed or loaded.\n\n**Recommendations:**\n\n**Replace:**\nhttps://github.com/mmaitre314/picklescan/blob/2a8383cfeb4158567f9770d86597300c9e508d0f/src/picklescan/scanner.py#L309C9-L309C54\n\n\n  `      unsafe_filter = _unsafe_globals.get(g.module)`\n\nby:\n```\n      matched_key = None\n        if imported_global.module:\n            for key_in_globals in unsafe_globals.keys():\n                # Check if imported_global.module starts with the key_in_globals AND\n                # (it\u0027s the first match OR this key is more specific than the previous match)\n                # AND imported_global.module is exactly the key or imported_global.module is key + \u0027.\u0027 + something\n                if imported_global.module.startswith(key_in_globals):\n                    if (imported_global.module == key_in_globals or # Exact match\n                            (len(imported_global.module) \u003e len(key_in_globals) and imported_global.module[len(key_in_globals)] == \u0027.\u0027)): # Submodule match\n                        if matched_key is None or len(key_in_globals) \u003e len(matched_key):\n                            matched_key = key_in_globals\n\n        if matched_key:\n            unsafe_filter = unsafe_globals[matched_key]\n```",
  "id": "GHSA-f7qq-56ww-84cr",
  "modified": "2025-09-18T12:51:26Z",
  "published": "2025-09-10T17:15:33Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-f7qq-56ww-84cr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10157"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mmaitre314/picklescan/pull/50"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mmaitre314/picklescan/commit/28a7b4ef753466572bda3313737116eeb9b4e5c5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mmaitre314/picklescan"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mmaitre314/picklescan/blob/2a8383cfeb4158567f9770d86597300c9e508d0f/src/picklescan/scanner.py#L309"
    },
    {
      "type": "WEB",
      "url": "https://huggingface.co/iluem/linux_pkl/resolve/main/asyncio_asyncio_unix_events___UnixSubprocessTransport__start.pkl"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Picklescan is Vulnerable to Unsafe Globals Check Bypass through Subclass Imports"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.