External risk intelligence

mmaitre314 picklescan ZIP Archive Scan Bypass Allows Malicious Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-10156

Picklescan is a security scanning utility typically used by developers or in CI/CD pipelines to inspect local files or repositories. It is not designed to be an internet-facing gateway, web service, or public API, making direct public network exposure unlikely in standard deployments.

Mmaitre314 Picklescan

before 0.0.31

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the ZIP archive scanning component of picklescan. This issue allows a remote attacker to bypass security checks by submitting a specially crafted ZIP file. If this file is processed, it could lead to the execution of malicious code.

Scans can be bypassed by a bad ZIP file.
This could allow malicious code execution.
Confirm relevance and assess exposure to this vulnerability.

Attack Path

How an attacker could exploit the issue

An attacker can send a specially crafted ZIP archive over the network to a system running the vulnerable scanning software. This archive contains a file with an intentionally corrupted Cyclic Redundancy Check (CRC). When the scanner attempts to process this archive, the bad CRC causes it to stop before fully analyzing the contents, mistakenly deeming the archive safe. If this archive is subsequently loaded into the application, it can lead to the execution of malicious code.

Attacker sends a malicious ZIP file.
Malformed CRC halts scanner incorrectly.
Leads to remote code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, a specially crafted ZIP archive with a bad CRC could cause the picklescan security scanning component to fail, potentially allowing malicious pickle files to be loaded and executed.

System data assets at risk.
Bypass security scans when processing ZIP archives.
Malicious code execution when unsafe files load.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in picklescan's ZIP archive scanning impacts teams responsible for code integrity and supply chain security, likely platform or security operations teams. The immediate priority is to confirm all instances of picklescan, ascertain their exposure, and identify business-critical uses to prioritize remediation efforts.

Platform and security teams own remediation.
Verify picklescan deployment and exposure.
Plan risk-based remediation and vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is mmaitre314 picklescan?

Picklescan is a security utility used by developers and automated build systems to inspect files for potentially malicious Python pickle data. It identifies insecure code patterns within archives before they are loaded, acting as a preventative layer in software supply chains and machine learning model pipelines.

What does CWE-755 mean for CVE-2025-10156?

This CVE involves CWE-755, or Improper Handling of Exceptional Conditions. In this context, it means the scanner encounters an error it does not know how to manage safely. Because the software fails to process a corrupted file correctly, it crashes or stops early rather than alerting the user to the danger.

How does a ZIP file trigger this bypass?

An attacker creates a ZIP archive containing a file with a deliberately corrupted Cyclic Redundancy Check (CRC). When picklescan tries to verify this file, the CRC error causes the scanner to halt prematurely. Consequently, the scanner fails to inspect the remaining contents, incorrectly marking the package as safe and allowing malicious code to persist.

Is my system at risk from this vulnerability?

Halo Surface Signal notes that picklescan is typically used in local development or CI/CD pipelines, making it unlikely to be an internet-facing service. You should care if your automated pipelines ingest untrusted external ZIP files or if picklescan is part of a workflow where outside parties can submit archives for automated processing.

How do I secure my environment against CVE-2025-10156?

Begin by auditing your infrastructure to identify all instances where picklescan is deployed. Once located, confirm the version in use and update to a patched release (0.0.31 or later) to resolve the scanning logic error. Prioritize these updates for any automated systems that handle files from external or untrusted sources.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.