What’s Vulnerable › Vulnerabilities

CVE-2025-1944: picklescan ZIP archive manipulation attack leads to crash

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-03-10 · updated 2026-06-17
• Weakness: CWE-345

Description

picklescan before 0.0.23 is vulnerable to a ZIP archive manipulation attack that causes it to crash when attempting to extract and scan PyTorch model archives. By modifying the filename in the ZIP header while keeping the original filename in the directory listing, an attacker can make PickleScan raise a BadZipFile error. However, PyTorch's more forgiving ZIP implementation still allows the model to be loaded, enabling malicious payloads to bypass detection.

Affected products

• picklescan: before 0.0.23 — fixed in 0.0.23

How to fix

Upgrade to a fixed version: picklescan 0.0.23. Check the vendor advisory for mitigations.

References

• https://github.com/mmaitre314/picklescan/commit/e58e45e0d9e091159c1554f9b04828bbb40b9781
• https://github.com/mmaitre314/picklescan/security/advisories/GHSA-7q5r-7gvp-wc82
• https://www.sonatype.com/security-advisories/cve-2025-1944

Get alerted when CVE-2025-1944 or the next vulnerability affects your stack