CVE-2025-10156
📋 TL;DR
This vulnerability allows attackers to bypass security scans in mmaitre314 picklescan by crafting ZIP archives with bad CRC values. When exploited, malicious pickle files can evade detection and execute arbitrary code. Anyone using picklescan to scan ZIP archives for malicious pickle files is affected.
💻 Affected Systems
- mmaitre314 picklescan
📦 What is this software?
Picklescan by Mmaitre314
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Malicious pickle files bypassing security scans and executing on vulnerable systems, potentially leading to malware installation or data exfiltration.
If Mitigated
Scanning bypass prevented, but system remains vulnerable to other attack vectors; no code execution occurs.
🎯 Exploit Status
Proof of concept is available in the GitHub advisory. Crafting malicious ZIP archives with bad CRC values is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v0.0.30
Vendor Advisory: https://github.com/mmaitre314/picklescan/security/advisories/GHSA-mjqp-26hc-grxg
Restart Required: No
Instructions:
1. Update picklescan to version v0.0.30 or later. 2. Run: pip install --upgrade picklescan>=0.0.30
🔧 Temporary Workarounds
Disable ZIP scanning
allTemporarily disable ZIP archive scanning in picklescan until patched
Modify configuration to skip ZIP files or use alternative scanning methods
Pre-scan validation
linuxUse external tools to validate ZIP integrity before picklescan processing
Use zip -T or similar commands to check CRC before scanning
🧯 If You Can't Patch
- Implement network segmentation to isolate systems running picklescan
- Deploy application allowlisting to prevent execution of unauthorized pickle files
🔍 How to Verify
Check if Vulnerable:
Check picklescan version: pip show picklescan | grep VersionCheck Version:
pip show picklescan | grep VersionVerify Fix Applied:
Confirm version is v0.0.30 or later and test with known malicious ZIP containing bad CRC📡 Detection & Monitoring
Log Indicators:
- Failed ZIP scans with CRC errors
- Picklescan process crashes during archive scanning
Network Indicators:
- Unusual outbound connections from systems after processing ZIP files
- Downloads of ZIP archives followed by pickle file execution
SIEM Query:
process.name:"picklescan" AND (event.action:"scan_failed" OR log.message:"CRC error")🔗 References
- https://github.com/mmaitre314/picklescan/blob/v0.0.29/src/picklescan/relaxed_zipfile.py#L35
- https://github.com/mmaitre314/picklescan/security/advisories/GHSA-mjqp-26hc-grxg
- https://huggingface.co/jinaai/jina-embeddings-v2-base-en/resolve/main/pytorch_model.bin?download=true
- https://huggingface.co/jinaai/jina-embeddings-v2-base-en/tree/main
