CVE-2025-1716

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

picklescan versions prior to 0.0.21 contain a flaw in which the scanner does not classify the 'pip' module as an unsafe global when inspecting pickled Python objects. The affected component is the picklescan library itself, which is used to detect dangerous constructs in serialized machine-learning models before they are loaded.

An attacker can therefore craft a malicious pickled model that invokes pip.main() to fetch and install an arbitrary package from PyPI or a GitHub-hosted repository. Because the call is not flagged, the model passes the scan and can later execute the attacker-supplied package when deserialized, achieving unauthorized code execution or environment tampering with no user interaction beyond loading the model.

The GitHub advisory GHSA-655q-fx9r-782v and the referenced commit 78ce704227c51f070c0c5fb4b466d92c62a7aa3d correct the issue by adding 'pip' to the set of restricted globals; Sonatype has mirrored the same remediation guidance for CVE-2025-1716.

The associated EPSS score has remained flat at 0.1625 since disclosure, indicating no measurable rise in observed exploitation interest, though the vulnerability is directly relevant to machine-learning pipelines that depend on pickle-based model serialization.