CVE-2025-10157

Summary

A Protection Mechanism Failure vulnerability in mmaitre314 picklescan versions up to and including 0.0.30 allows a remote attacker to bypass the unsafe globals check. This is possible because the scanner performs an exact match for module names, allowing malicious payloads to be loaded via submodule

Severity

high

EPSS

0.8% (p50)

Also known as

GHSA-f7qq-56ww-84cr, PYSEC-2025-153

Published

2025-09-17

References

• https://github.com/mmaitre314/picklescan/blob/2a8383cfeb4158567f9770d86597300c9e508d0f/src/picklescan/scanner.py#L309
• https://huggingface.co/iluem/linux_pkl/resolve/main/asyncio_asyncio_unix_events___UnixSubprocessTransport__start.pkl
• https://github.com/mmaitre314/picklescan/security/advisories/GHSA-f7qq-56ww-84cr

Related advisories

• GHSA-g38g-8gr9-h9xp — critical · PyPI/picklescan
• CVE-2026-3490 — critical · PyPI/picklescan
• CVE-2026-53873 — critical · PyPI/picklescan
• CVE-2025-10156 — critical · PyPI/picklescan
• CVE-2026-53875 — high · PyPI/picklescan
• CVE-2026-53874 — high · PyPI/picklescan
• CVE-2026-53872 — high · PyPI/picklescan
• GHSA-46h3-79wf-xr6c — high · PyPI/picklescan

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity