{"items":[{"id":"NVI-00018601","kind":"vulnerability","title":"Picklescan is Vulnerable to Unsafe Globals Check Bypass through Subclass Imports","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-f7qq-56ww-84cr","CVE-2025-10157"],"plain_summary":"GitHub lists this reviewed advisory for picklescan. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-4289e59f3603dc7bf9590d746be40523"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-06T14:43:05.000Z","value":"8.3 critical","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-4289e59f3603dc7bf9590d746be40523"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-4289e59f3603dc7bf9590d746be40523","url":"https://github.com/advisories/GHSA-f7qq-56ww-84cr","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-f7qq-56ww-84cr","publisher":"GitHub Advisory Database","observed_at":"2026-11-07T00:52:42.537Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-4289e59f3603dc7bf9590d746be40523"],"technology":"picklescan","known_exclusions":[],"conditions_summary":"### Summary\nThe vulnerability allows malicious actors to bypass PickleScan's unsafe globals check, leading to potential arbitrary code execution. The issue stems from PickleScan's strict check for full module names against its list of unsafe globals. By using subclasses of dangerous imports instead of the exact module names, attackers can circumvent the check and inject malicious payloads.\n\n### PoC\n1. Download a model that uses the `asyncio` package: \n\n```wget https://huggingface.co/iluem/linux_pkl/resolve/main/asyncio_asyncio_unix_events___UnixSubprocessTransport__start.pkl```\n\n2. Check with PickleScan: `picklescan -p asyncio_asyncio_unix_events___UnixSubprocessTransport__start.pkl -g`\n\n**Expected Result:**\n\nPickleScan should identify all `asyncio` import as dangerous and flag the pickle file as malicious as `asyncio` is in `_unsafe_globals` dictionary.\n\n**Actual Result:**\n!Screenshot 2025-06-29 at 14 13 38\n\nPickleScan marked the import as Suspicious, failing to identify it as a dangerous import.\n\n### Impact\n**Severity**: High\n**Affected Users**: Any organization, like HuggingFace, or individual usi","public_affected_ranges":["<= 0.0.30"]}],"null_published_at":"2026-11-07T07:07:39.860Z","source_updated_at":"2026-06-06T14:43:05.000Z","source_disclosed_at":"2025-09-10T17:15:33.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-07T00:52:42.537Z"}],"next_cursor":null,"snapshot_revision":"42594"}