CVE-2025-1944
📋 TL;DR
CVE-2025-1944 is a ZIP archive manipulation vulnerability in picklescan versions before 0.0.23 that allows malicious PyTorch model files to bypass security scanning. Attackers can craft archives with mismatched filenames in ZIP headers versus directory listings, causing picklescan to crash while PyTorch still loads the model. This affects anyone using picklescan to scan potentially untrusted PyTorch model files for malicious pickle payloads.
💻 Affected Systems
- picklescan
📦 What is this software?
Picklescan by Mmaitre314
⚠️ Risk & Real-World Impact
Worst Case
Malicious PyTorch models with arbitrary code execution payloads bypass security scanning entirely, leading to remote code execution on systems processing these models.
Likely Case
Attackers deliver malicious machine learning models that evade detection, potentially compromising AI/ML pipelines and data processing systems.
If Mitigated
With proper controls, the impact is limited to scanning failures that could be detected through monitoring, though malicious models might still be processed.
🎯 Exploit Status
Exploitation requires creating specially crafted ZIP archives with mismatched filenames, which is straightforward for attackers familiar with ZIP format manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.0.23
Vendor Advisory: https://github.com/mmaitre314/picklescan/security/advisories/GHSA-7q5r-7gvp-wc82
Restart Required: No
Instructions:
1. Update picklescan to version 0.0.23 or later using pip: pip install --upgrade picklescan>=0.0.23
2. Verify the update completed successfully
3. No restart required as picklescan is typically used as a command-line tool
🔧 Temporary Workarounds
Manual ZIP validation before scanning
allValidate ZIP archives with standard tools before passing to picklescan to detect malformed archives
python -m zipfile -t suspicious_model.zip
Use alternative scanning tools
allSupplement picklescan with additional security scanning tools for PyTorch models
🧯 If You Can't Patch
- Implement strict input validation on all PyTorch model files before processing
- Run picklescan in isolated environments with crash monitoring to detect scanning failures
🔍 How to Verify
Check if Vulnerable:
Check picklescan version: picklescan --version | grep -q '^0\.0\.2[0-2]$' && echo 'VULNERABLE'Check Version:
picklescan --versionVerify Fix Applied:
Verify version is 0.0.23 or higher: picklescan --version | grep -q '^0\.0\.2[3-9]\|^0\.0\.[3-9]\|^0\.[1-9]' && echo 'PATCHED'📡 Detection & Monitoring
Log Indicators:
- picklescan crash logs with BadZipFile errors
- Unexpected scanning failures on PyTorch model files
Network Indicators:
- Downloads of PyTorch model files from untrusted sources
SIEM Query:
process.name='picklescan' AND (event.outcome='failure' OR event.action='crash')