{"cve":"CVE-2025-1716","nvd":{"published":"2025-02-26T15:15:24.653","modified":"2026-06-17T08:39:39.370","status":"Modified","description":"picklescan before 0.0.21 does not treat 'pip' as an unsafe global. An attacker could craft a malicious model that uses Pickle to pull in a malicious PyPI package (hosted, for example, on pypi.org or GitHub) via `pip.main()`. Because pip is not a restricted global, the model, when scanned with picklescan, would pass security checks and appear to be safe, when it could instead prove to be problematic.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","score":5.3},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-184"],"references":["https://github.com/mmaitre314/picklescan/commit/78ce704227c51f070c0c5fb4b466d92c62a7aa3d","https://github.com/mmaitre314/picklescan/security/advisories/GHSA-655q-fx9r-782v","https://www.sonatype.com/security-advisories/cve-2025-1716"],"products":["mmaitre314:picklescan"],"source":"nvd","synced_at":"2026-10-19T21:59:48.811064707+00:00"},"epss":{"cve":"CVE-2025-1716","score":0.01723,"percentile":0.77504,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-655q-fx9r-782v","url":"https://osv.dev/vulnerability/GHSA-655q-fx9r-782v","summary":"Picklescan Allows Remote Code Execution via Malicious Pickle File Bypassing Static Analysis","modified":"2025-04-09T20:52:48.178566Z","packages":[{"ecosystem":"PyPI","name":"picklescan","purl":"pkg:pypi/picklescan","ranges":["<0.0.22"],"fixed":["0.0.22"]}]},{"id":"GHSA-769v-p64c-89pr","url":"https://osv.dev/vulnerability/GHSA-769v-p64c-89pr","summary":"PyTorch Model Files Can Bypass Pickle Scanners via Unexpected Pickle Extensions","modified":"2025-04-09T17:59:23.478228Z","packages":[{"ecosystem":"PyPI","name":"picklescan","purl":"pkg:pypi/picklescan","ranges":["<0.0.22"],"fixed":["0.0.22"]}]},{"id":"PYSEC-2025-18","url":"https://osv.dev/vulnerability/PYSEC-2025-18","summary":"","modified":"2025-04-09T17:59:23.478228Z","packages":[{"ecosystem":"PyPI","name":"picklescan","purl":"pkg:pypi/picklescan","ranges":["<0.0.21"],"fixed":["0.0.21"]}]},{"id":"PYSEC-2025-19","url":"https://osv.dev/vulnerability/PYSEC-2025-19","summary":"","modified":"2026-07-09T16:45:06.417394050Z","packages":[{"ecosystem":"PyPI","name":"picklescan","purl":"pkg:pypi/picklescan","ranges":["<0.0.22"],"fixed":["0.0.22"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}