{"data":{"id":"d2c40adf-40dc-462f-b53f-0ab9d1f42ecb","title":"CVE-2025-1945: picklescan before 0.0.23 fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file…","summary":"picklescan before 0.0.23 fails to detect malicious pickle files embedded in PyTorch model archives when specific ZIP header flag bits are flipped. Such a file still loads through torch.load(), which can lead to arbitrary code execution when a compromised model is loaded. The source gives a Sonatype CVSS 4.0 score of 5.3 (MEDIUM) and CWE-345, while NIST's assessment is not yet provided.","solution":"The source links a fix commit (github.com/mmaitre314/picklescan/commit/e58e45e0d9e091159c1554f9b04828bbb40b9781) and advisory GHSA-w8jq-xcqf-f792, and the title indicates the issue is fixed in picklescan 0.0.23 or later.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-1945","publishedAt":"2025-03-10T16:15:12.450Z","cveId":"CVE-2025-1945","cweIds":["CWE-345"],"cvssScore":"9.8","cvssSeverity":"critical","severity":"critical","attackType":["supply_chain","model_poisoning"],"issueType":"vulnerability","affectedPackages":["picklescan@< 0.0.23 (fixed: 0.0.23)"],"affectedPackageNames":["picklescan"],"affectedPackageRefs":["pypi:picklescan"],"affectedVendors":[],"affectedVendorsRaw":["picklescan","PyTorch"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"picklescan flaw lets malicious pickles hide in PyTorch model ZIP archives","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00554,"epssCheckedAt":"2026-11-04T18:09:13.386Z","kevDateAdded":null,"advisoryAliases":["GHSA-w8jq-xcqf-f792"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:54:31.020Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-03-09T22:32:39.127Z","daysToFix":-1,"fixCheckedAt":"2026-10-29T21:45:05.422Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[{"ecosystem":"pypi","name":"picklescan","fixedVersion":"0.0.23","matchedVersion":"0.0.23","fixReleasedAt":"2025-03-09T22:32:39.127Z","daysToFix":-1,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:45:05.272Z"}]}}