CVE-2025-10157
📋 TL;DR
This vulnerability allows attackers to bypass picklescan's unsafe globals check by using submodule imports instead of exact package names. Attackers can load malicious pickle files that appear safe during scanning but execute arbitrary code when loaded. Anyone using picklescan versions up to 0.0.30 to validate pickle files is affected.
💻 Affected Systems
- mmaitre314 picklescan
📦 What is this software?
Picklescan by Mmaitre314
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Malicious pickle files bypassing security checks and executing arbitrary code in applications that rely on picklescan for validation.
If Mitigated
Limited impact with proper network segmentation, least privilege, and additional validation layers.
🎯 Exploit Status
Proof-of-concept pickle files are publicly available. Exploitation requires the target to load a malicious pickle file after scanning.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.0.31 or later
Vendor Advisory: https://github.com/mmaitre314/picklescan/security/advisories/GHSA-f7qq-56ww-84cr
Restart Required: No
Instructions:
1. Update picklescan: pip install --upgrade picklescan
2. Verify version is 0.0.31 or higher
3. Re-scan any previously scanned pickle files
🔧 Temporary Workarounds
Manual submodule validation
allAdd custom validation to check for dangerous submodule imports in pickle files
# Custom Python script to validate pickle imports beyond picklescan
🧯 If You Can't Patch
- Disable pickle file processing from untrusted sources entirely
- Implement additional validation layers using multiple security tools
🔍 How to Verify
Check if Vulnerable:
Check picklescan version: pip show picklescan | grep VersionCheck Version:
python -c "import picklescan; print(picklescan.__version__)"Verify Fix Applied:
Confirm version is 0.0.31 or higher and test with known malicious pickle files📡 Detection & Monitoring
Log Indicators:
- Failed or bypassed picklescan validations
- Unusual pickle file processing activity
Network Indicators:
- Unexpected pickle file uploads to web applications
SIEM Query:
process.name:python AND command_line:*pickle* AND (command_line:*asyncio.unix_events* OR command_line:*submodule*)🔗 References
- https://github.com/mmaitre314/picklescan/blob/2a8383cfeb4158567f9770d86597300c9e508d0f/src/picklescan/scanner.py#L309
- https://github.com/mmaitre314/picklescan/security/advisories/GHSA-f7qq-56ww-84cr
- https://huggingface.co/iluem/linux_pkl/resolve/main/asyncio_asyncio_unix_events___UnixSubprocessTransport__start.pkl
