Database/AI/ML frameworks & serving
picklescan: Improper input validation lets a crafted pickle evade scanning
CVSS 7.8CVE-2025-10155AI/ML frameworks & servingcurated
Impact
Improper input validation lets a crafted pickle evade scanning
Who can reach it
Customer-supplied model file
What to do
Upgrade past 0.0.30; layer scanning with format restriction
References
Related entries
- picklescan: `scan_pytorch` bypass via forged magic numbersCVE-2026-53875 · picklescanHigh
- picklescan: ZIP manipulation crashes the scanner (scan bypass by DoS)CVE-2025-1944 · picklescanMedium
- picklescan: Misses `idlelib.pyshell.ModifiedInterpreter.runcode` gadgetCVE-2025-71340 · picklescanHigh
- picklescan: Misses `idlelib.run.Executive.runcode` gadgetCVE-2025-71342 · picklescanHigh
- LlamaIndex CLI: OS command injection via the `--files` argumentCVE-2025-1753 · LlamaIndex CLIHigh
- nbconvert: Template-driven conversion executes attacker contentCVE-2025-53000 · nbconvertHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.