CVE-2025-10156
An Improper Handling of Exceptional Conditions vulnerability in the ZIP archive scanning component of mmaitre314 picklescan allows a remote attacker to bypass security scans.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.48%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
An Improper Handling of Exceptional Conditions vulnerability in the ZIP archive scanning component of mmaitre314 picklescan allows a remote attacker to bypass security scans. This is achieved by crafting a ZIP archive containing a file with a bad Cyclic Redundancy Check (CRC), which causes the scanner to halt and fail to analyze the contents for malicious pickle files. When the file incorrectly considered safe is loaded, it can lead to the execution of malicious code.
- CVSS 4.0
- 9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 1.48% probability · 72th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-755
- Affected
- mmaitre314/picklescan
- Source
- reefs@jfrog.com
References
- https://github.com/mmaitre314/picklescan/blob/v0.0.29/src/picklescan/relaxed_zipfile.py#L35Product
- https://github.com/mmaitre314/picklescan/security/advisories/GHSA-mjqp-26hc-grxgExploit, Vendor Advisory
- https://huggingface.co/jinaai/jina-embeddings-v2-base-en/resolve/main/pytorch_model.bin?download=trueNot Applicable
- https://huggingface.co/jinaai/jina-embeddings-v2-base-en/tree/mainNot Applicable
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.