CVE-2025-10156

Summary

An Improper Handling of Exceptional Conditions vulnerability in the ZIP archive scanning component of mmaitre314 picklescan allows a remote attacker to bypass security scans. This is achieved by crafting a ZIP archive containing a file with a bad Cyclic Redundancy Check (CRC), which causes the scann

Severity

critical

EPSS

1.4% (p70)

Also known as

GHSA-mjqp-26hc-grxg, PYSEC-2025-152

Published

2025-09-17

References

• https://github.com/mmaitre314/picklescan/blob/v0.0.29/src/picklescan/relaxed_zipfile.py#L35
• https://huggingface.co/jinaai/jina-embeddings-v2-base-en/resolve/main/pytorch_model.bin?download=true
• https://huggingface.co/jinaai/jina-embeddings-v2-base-en/tree/main

Related advisories

• GHSA-g38g-8gr9-h9xp — critical · PyPI/picklescan
• CVE-2026-3490 — critical · PyPI/picklescan
• CVE-2026-53873 — critical · PyPI/picklescan
• CVE-2026-53875 — high · PyPI/picklescan
• CVE-2026-53874 — high · PyPI/picklescan
• CVE-2026-53872 — high · PyPI/picklescan
• GHSA-46h3-79wf-xr6c — high · PyPI/picklescan
• GHSA-955r-x9j8-7rhh — high · PyPI/picklescan

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity