CVE-2025-10157 json
PickleScan Bypasses Unsafe Globals Check Using Submodule Imports
published 2025-09-10 13 mo ago modified 2026-09-26 44 d ago also EUVD-2025-29711 , GHSA-f7qq-56ww-84cr , PYSEC-2025-153
- cvss
- 7.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 56%
- public exploits
- 0
- none known
Summary
A Protection Mechanism Failure vulnerability in mmaitre314 picklescan versions up to and including 0.0.30 allows a remote attacker to bypass the unsafe globals check. This is possible because the scanner performs an exact match for module names, allowing malicious payloads to be loaded via submodules of dangerous packages (e.g., 'asyncio.unix_events' instead of 'asyncio').
When the incorrectly considered safe file is loaded after scan, it can lead to the execution of malicious code.
Patch / fix
- pypi picklescan 0.0.31
- mmaitre314 picklescan 0.0.31
- github.com/mmaitre314/picklescan@28a7b4e commit
- github.com/mmaitre314/picklescan#50 pull request
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 13 mo ago
Exploit prediction
0.79% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/mmaitre314/picklescan/security/advisories/GHSA-f7qq-56ww-84cr referenced PoC, tagged "exploit" by a source, unverified
- huggingface.co https://huggingface.co/iluem/linux_pkl/resolve/main/asyncio_asyncio_unix_events___UnixSubprocessTransport__start.pkl referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| GitHub | 3.1 | 8.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L |
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | picklescan | <0.0.31 |
0.0.31 |
Affected products
- mmaitre314 picklescan
Classification
- Weakness
-
- CWE-693 Protection Mechanism Failure
References
-
github.com
/mmaitre314/picklescan/pull/50
web
-
github.com
/mmaitre314/picklescan/commit/28a7b4ef753466572bda3313737116eeb9b4e5c5
web
-
github.com
/mmaitre314/picklescan/security/advisories/GHSA-f7qq-56ww-84cr
vendor-advisory, exploit, web, evidence
-
huggingface.co
/iluem/linux_pkl/resolve/main/asyncio_asyncio_unix_events___UnixSubprocessTransport__start.pkl
exploit, web, broken-link
-
github.com
/mmaitre314/picklescan/blob/2a8383cfeb4158567f9770d86597300c9e508d0f/src/picklescan/scanner.py#L309
web, product
-
nvd.nist.gov
/vuln/detail/CVE-2025-10157
advisory
-
github.com
/mmaitre314/picklescan
package
-
github.com
/pypa/advisory-database/tree/main/vulns/picklescan/PYSEC-2025-153.yaml
web
Sources
- CVE List CVE-2025-10157
- GitHub Advisory GHSA-f7qq-56ww-84cr
- NVD CVE-2025-10157
- OSV PYSEC-2025-153
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.