{"cve":"CVE-2025-1889","nvd":{"published":"2025-03-03T19:15:34.560","modified":"2026-06-17T08:40:16.550","status":"Modified","description":"picklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. An attacker could craft a malicious model that uses Pickle and include a malicious pickle file with a non-standard file extension. Because the malicious pickle file inclusion is not considered as part of the scope of picklescan, the file would pass security checks and appear to be safe, when it could instead prove to be problematic.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","score":5.3},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-646"],"references":["https://github.com/mmaitre314/picklescan/security/advisories/GHSA-655q-fx9r-782v","https://www.sonatype.com/security-advisories/cve-2025-1889"],"products":["mmaitre314:picklescan"],"source":"nvd","synced_at":"2026-10-19T21:59:48.811064707+00:00"},"epss":{"cve":"CVE-2025-1889","score":0.00395,"percentile":0.33759,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-655q-fx9r-782v","url":"https://osv.dev/vulnerability/GHSA-655q-fx9r-782v","summary":"Picklescan Allows Remote Code Execution via Malicious Pickle File Bypassing Static Analysis","modified":"2025-04-09T20:52:48.178566Z","packages":[{"ecosystem":"PyPI","name":"picklescan","purl":"pkg:pypi/picklescan","ranges":["<0.0.22"],"fixed":["0.0.22"]}]},{"id":"GHSA-769v-p64c-89pr","url":"https://osv.dev/vulnerability/GHSA-769v-p64c-89pr","summary":"PyTorch Model Files Can Bypass Pickle Scanners via Unexpected Pickle Extensions","modified":"2025-04-09T17:59:23.478228Z","packages":[{"ecosystem":"PyPI","name":"picklescan","purl":"pkg:pypi/picklescan","ranges":["<0.0.22"],"fixed":["0.0.22"]}]},{"id":"PYSEC-2025-18","url":"https://osv.dev/vulnerability/PYSEC-2025-18","summary":"","modified":"2025-04-09T17:59:23.478228Z","packages":[{"ecosystem":"PyPI","name":"picklescan","purl":"pkg:pypi/picklescan","ranges":["<0.0.21"],"fixed":["0.0.21"]}]},{"id":"PYSEC-2025-19","url":"https://osv.dev/vulnerability/PYSEC-2025-19","summary":"","modified":"2026-07-09T16:45:06.417394050Z","packages":[{"ecosystem":"PyPI","name":"picklescan","purl":"pkg:pypi/picklescan","ranges":["<0.0.22"],"fixed":["0.0.22"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}