Vulnerability in Mmaitre314 Picklescan
CVE-2025-10156
An Improper Handling of Exceptional Conditions vulnerability in the ZIP archive scanning component of mmaitre314 picklescan allows a remote attacker to bypass security scans. This is achieved by crafting a ZIP archive containing a file with a bad Cyclic Redundancy Check (CRC), which causes the scanner to halt and fail to analyze the contents for malicious pickle files. When the file incorrectly considered safe is loaded, it can lead to the execution of malicious code.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.015 (72.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 73rd percentile — 72.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.015 · newest: 0.015 · change: 0.000
Affected products
- Mmaitre314 Picklescan — versions 0
Weakness classification (CWE)
References
- huggingface.co/jinaai/jina-embeddings-v2-base-en/resolve/main/pytorch_model.bin (exploit, Not Applicable)
- huggingface.co/jinaai/jina-embeddings-v2-base-en/tree/main (exploit, Not Applicable)
- github.com/mmaitre314/picklescan/blob/v0.0.29/src/picklescan/relaxed_zipfile.py (related, Product)
- github.com/mmaitre314/picklescan/security/advisories/GHSA-mjqp-26hc-grxg (Exploit, vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-10156?
- CVE-2025-10156 is a critical-severity vulnerability in Mmaitre314 Picklescan, classified under Improper Handling of Exceptional Conditions. CVSS score: 9.8/10. Published 2025-09-17.
- How severe is CVE-2025-10156?
- Critical severity. CVSS v3 base score is 9.8 out of 10.