{"items":[{"id":"NVI-00018627","kind":"vulnerability","title":"Picklescan Bypass is Possible via File Extension Mismatch","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-jgw4-cr84-mqxg","CVE-2025-10155"],"plain_summary":"GitHub lists this reviewed advisory for picklescan. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-4690060385ef3b43adb2f175451a2324"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-06T14:44:25.000Z","value":"7.8 critical","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-4690060385ef3b43adb2f175451a2324"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-4690060385ef3b43adb2f175451a2324","url":"https://github.com/advisories/GHSA-jgw4-cr84-mqxg","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-jgw4-cr84-mqxg","publisher":"GitHub Advisory Database","observed_at":"2026-11-07T00:52:42.537Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-4690060385ef3b43adb2f175451a2324"],"technology":"picklescan","known_exclusions":[],"conditions_summary":"### Summary\nPicklescan can be bypassed, allowing the detection of malicious pickle files to fail, when a standard pickle file is given a PyTorch-related file extension (e.g., .bin). This occurs because the scanner prioritizes PyTorch file extension checks and errors out when parsing a standard pickle file with such an extension instead of falling back to standard pickle analysis. This vulnerability allows attackers to disguise malicious pickle payloads within files that would otherwise be scanned for pickle-based threats.\n### Details\nThe vulnerability stems from the logic in the scan_bytes function within picklescan/scanner.py, specifically around line 463: https://github.com/mmaitre314/picklescan/blob/75e60f2c02f3f1a029362e6f334e1921392dcf60/src/picklescan/scanner.py#L463\nThe code first checks if the file extension (file_ext) is in the pytorch_file_extension list. If it is (e.g., .bin), the scan_pytorch function is called. When a standard pickle file is encountered with a PyTorch extension, scan_pytorch will likely fail. Critically, the code then returns an Erro","public_affected_ranges":["<= 0.0.30"]}],"null_published_at":"2026-11-07T07:07:39.864Z","source_updated_at":"2026-06-06T14:44:25.000Z","source_disclosed_at":"2025-09-10T19:51:37.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-07T00:52:42.537Z"}],"next_cursor":null,"snapshot_revision":"42594"}