CVE-2025-1945 - CVE House
Back to Database
Status published Medium CVE-2025-1945

picklescan - Zip Flag Bit Exploit Crashes Picklescan But Not PyTorch

Vulnerability Description

picklescan before 0.0.23 fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag bits are modified. By flipping specific bits in the ZIP file headers, an attacker can embed malicious pickle files that remain undetected by PickleScan while still being successfully loaded by PyTorch's torch.load(). This can lead to arbitrary code execution when loading a compromised model.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-1945

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Trevor Madge (@madgetr) of Sonatype

References

More from mmaitre314

View All →
CVE-2025-1944
picklescan ZIP archive manipulation attack leads to crash
Medium 5.3
CVE-2025-1889
picklescan - Security scanning bypass via non-standard file extensions
Medium 5.3
CVE-2025-1716
picklescan - Security scanning bypass via 'pip main'
Medium 5.3
CVE-2025-10157
PickleScan Bypasses Unsafe Globals Check Using Submodule Imports
Critical 9.3
CVE-2025-10156
PickleScan Security Bypass via Bad CRC in ZIP Archive
Critical 9.3

Affected Vendor

Affected Software

picklescan
Vulnerable Versions:
0.0.1

Timeline

Official Publish: March 10th, 2025
Last Modified: December 29th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-345

MITRE ATT&CK TTPs

T1557 Adversary-in-the-Middle
Credential Access
T1071 Application Layer Protocol
Command and Control
T1552 Unsecured Credentials
Credential Access
T1190 Exploit Public-Facing Application
Initial Access
T1041 Exfiltration Over C2 Channel
Exfiltration