CVE-2025-1889
Published: 03 March 2025
Summary
CVE-2025-1889 is a critical-severity Reliance on File Name or Extension of Externally-Supplied File (CWE-646) vulnerability in Mmaitre314 Picklescan. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Masquerade File Type (T1036.008); ranked at the 14.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as Other Platforms; in the Supply Chain and Deployment risk domain.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires identification, prioritization, and remediation of flaws like CVE-2025-1889 in picklescan to eliminate false negatives from non-standard pickle file extensions.
Mandates employment of updatable vulnerability scanning tools that address limitations such as CVE-2025-1889's scope restriction to standard extensions, ensuring comprehensive detection of unsafe pickles.
Ensures receipt and dissemination of security advisories like GHSA-655q-fx9r-782v for CVE-2025-1889, enabling timely awareness and patching of the scanning tool vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability allows bypassing picklescan detection of malicious pickle deserialization payloads via non-standard file extensions or undetected unsafe globals (e.g., pip.main), enabling file type masquerading, embedding payloads in archives like PyTorch models, and exploitation of security scanning tools for defense evasion leading to RCE.
NVD Description
picklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. An attacker could craft a malicious model that uses Pickle and include a malicious pickle file with a non-standard file extension. Because the malicious…
more
pickle file inclusion is not considered as part of the scope of picklescan, the file would pass security checks and appear to be safe, when it could instead prove to be problematic.
Deeper analysisAI
CVE-2025-1889 is a critical vulnerability (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) affecting picklescan versions prior to 0.0.22. Picklescan is a vulnerability scanning tool that detects unsafe pickle usage in Python files, but it only considers files with standard pickle extensions (such as .pkl or .pickle) within its scan scope. This limitation allows malicious pickle files with non-standard extensions to evade detection, leading to false negatives where unsafe files appear secure. The issue is linked to CWE-646 (Reliance on File Name or Extension) and NVD-CWE-noinfo.
An attacker can exploit this vulnerability by crafting a malicious Python model or package that incorporates a dangerous pickle file renamed with a non-standard extension. A security practitioner or developer using the vulnerable picklescan to scan a repository or artifact containing this malicious file would receive a clean bill of health, potentially leading to the file being trusted and loaded. Upon deserialization, the pickle file could execute arbitrary code, resulting in high confidentiality, integrity, and availability impacts remotely with no authentication or user interaction required.
The GitHub security advisory (GHSA-655q-fx9r-782v) and Sonatype advisory detail mitigation steps, primarily recommending an upgrade to picklescan 0.0.22 or later, which expands the scan scope to include non-standard pickle extensions and prevents such bypasses. Practitioners should rescan existing models or dependencies after patching to identify previously missed threats.
Details
- CWE(s)
Affected Products
AI Security AnalysisAI
- AI Category
- Other Platforms
- Risk Domain
- Supply Chain and Deployment
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Picklescan is a security scanning tool specifically designed to detect vulnerabilities in Python pickle files, which are commonly used for serializing machine learning models (e.g., in PyTorch via torch.load()). The vulnerability enables bypassing scans for malicious pickles embedded in ML models with non-standard extensions, directly impacting AI/ML model security.