What is CVE-2025-1889?

CVE-2025-1889 is a vulnerability in Mmaitre314 Picklescan, classified under CWE-646. Published 2025-03-03.

Is CVE-2025-1889 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Mmaitre314 Picklescan

CVE-2025-1889

picklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. An attacker could craft a malicious model that uses Pickle and include a malicious pickle file with a non-standard file extens…

EPSS: 0.001 (18.0th percentile) — read the EPSS interpretation.

Affected products

Mmaitre314 Picklescan — versions 0.0.1

Weakness classification (CWE)

CWE-646

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

www.sonatype.com/security-advisories/cve-2025-1889 (third-party-advisory)
github.com/mmaitre314/picklescan/security/advisories/GHSA-655q-fx9r-782v (third-party-advisory)

Frequently asked questions

What is CVE-2025-1889?: CVE-2025-1889 is a vulnerability in Mmaitre314 Picklescan, classified under CWE-646. Published 2025-03-03.
Is CVE-2025-1889 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.