CVE-2025-1716

picklescan before 0.0.21 does not treat 'pip' as an unsafe global. An attacker could craft a malicious model that uses Pickle to pull in a malicious PyPI package (hosted, for example, on pypi.org or GitHub) via `pip.main()`. Because pip is not a restricted global, the model, when scanned with picklescan, would pass security checks and appear to be safe, when it could instead prove to be problematic.

CVSS

No CVSS.

References

Link	Resource
https://github.com/mmaitre314/picklescan/commit/78ce704227c51f070c0c5fb4b466d92c62a7aa3d
https://github.com/mmaitre314/picklescan/security/advisories/GHSA-655q-fx9r-782v
https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-1716

Configurations

No configuration.

History

03 Mar 2025, 16:15

Type	Values Removed	Values Added
Summary		(es) Las versiones anteriores a la versión 0.0.21 de picklescan no tratan a 'pip' como una variable global insegura. Un atacante podría manipular un modelo malicioso que use Pickle para incorporar un paquete PyPI malicioso (alojado, por ejemplo, en pypi.org o GitHub) a través de `pip.main()`. Debido a que pip no es una variable global restringida, el modelo, al analizarse con picklescan, pasaría los controles de seguridad y parecería ser seguro, cuando en realidad podría resultar problemático.
References		() https://github.com/mmaitre314/picklescan/security/advisories/GHSA-655q-fx9r-782v -

26 Feb 2025, 15:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-02-26 15:15

Updated : 2025-03-03 16:15

NVD link : CVE-2025-1716

Mitre link : CVE-2025-1716

CVE.ORG link : CVE-2025-1716

JSON object : View

Products Affected

No product.

CWE

CWE-184

Incomplete List of Disallowed Inputs

{"id": "CVE-2025-1716", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "103e4ec9-0a87-450b-af77-479448ddef11", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-02-26T15:15:24.653", "references": [{"url": "https://github.com/mmaitre314/picklescan/commit/78ce704227c51f070c0c5fb4b466d92c62a7aa3d", "source": "103e4ec9-0a87-450b-af77-479448ddef11"}, {"url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-655q-fx9r-782v", "source": "103e4ec9-0a87-450b-af77-479448ddef11"}, {"url": "https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-1716", "source": "103e4ec9-0a87-450b-af77-479448ddef11"}], "vulnStatus": "Received", "weaknesses": [{"type": "Secondary", "source": "103e4ec9-0a87-450b-af77-479448ddef11", "description": [{"lang": "en", "value": "CWE-184"}]}], "descriptions": [{"lang": "en", "value": "picklescan before 0.0.21 does not treat 'pip' as an unsafe global. An attacker could craft a malicious model that uses Pickle to pull in a malicious PyPI package (hosted, for example, on pypi.org or GitHub) via `pip.main()`. Because pip is not a restricted global, the model, when scanned with picklescan, would pass security checks and appear to be safe, when it could instead prove to be problematic."}, {"lang": "es", "value": "Las versiones anteriores a la versi\u00f3n 0.0.21 de picklescan no tratan a 'pip' como una variable global insegura. Un atacante podr\u00eda manipular un modelo malicioso que use Pickle para incorporar un paquete PyPI malicioso (alojado, por ejemplo, en pypi.org o GitHub) a trav\u00e9s de `pip.main()`. Debido a que pip no es una variable global restringida, el modelo, al analizarse con picklescan, pasar\u00eda los controles de seguridad y parecer\u00eda ser seguro, cuando en realidad podr\u00eda resultar problem\u00e1tico."}], "lastModified": "2025-03-03T16:15:39.520", "sourceIdentifier": "103e4ec9-0a87-450b-af77-479448ddef11"}