GHSA-jgw4-cr84-mqxg: 
Python vulnerability analysis and mitigation

A critical vulnerability (GHSA-jgw4-cr84-mqxg) was discovered in mmaitre314 picklescan versions up to and including 0.0.30, identified as CVE-2025-10155. The vulnerability allows remote attackers to bypass pickle files security checks by supplying a standard pickle file with a PyTorch-related file extension. The issue was disclosed on September 8, 2025, and affects the scanning logic of the picklescan security tool (GitHub Advisory).

The vulnerability stems from an improper input validation in the scan_bytes function within picklescan/scanner.py. When a file with a PyTorch-related extension (e.g., .bin) is encountered, the scanner prioritizes PyTorch file extension checks and errors out when parsing a standard pickle file with such an extension, instead of falling back to standard pickle analysis. The vulnerability has been assigned a CVSS v4.0 score of 9.3 CRITICAL with vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (NVD).

The vulnerability significantly weakens the security provided by PickleScan, enabling attackers to bypass security checks by disguising malicious pickle payloads within files using common PyTorch extensions. This affects any organization or individual relying on PickleScan for ensuring the safety of PyTorch models or other files containing embedded pickle objects. The vulnerability opens the door to supply chain attacks, where malicious actors could distribute backdoored models through platforms like Hugging Face, PyTorch Hub, or direct file sharing (GitHub Advisory).

The vulnerability has been patched in version 0.0.31 of picklescan. The fix modifies the scanning logic to ensure that standard pickle scanning is attempted as a fallback mechanism when PyTorch scanning fails. The patch implements a two-step approach: first attempting PyTorch scan for files with matching extensions, then falling back to standard pickle analysis regardless of the initial scan's outcome. Users are strongly advised to upgrade to version 0.0.31 or later (GitHub Advisory).