CVE-2025-10156 is a critical scan bypass (CVSS 9.8) in picklescan up to 0.0.30. A ZIP archive with a bad CRC makes the scanner stop and report nothing, so a malicious pickle can look safe. Upgrade to picklescan 0.0.31 and treat errored scans as unscanned.
What's affected
Per the maintainer's GitHub advisory, picklescan versions up to and including 0.0.30 are affected, and 0.0.31 is the patched version. The NVD record names the ZIP archive scanning component of mmaitre314 picklescan.
The cause is a failure to handle an error. When a ZIP archive contains a file with a bad Cyclic Redundancy Check (CRC), the scanner halts and does not analyze the other contents. The advisory says PyTorch often skips CRC checks, so a model file that picklescan cannot read may still load in PyTorch. NVD classes the weakness as CWE-755 (improper handling of exceptional conditions), and the advisory describes it as a protection mechanism failure.
The score is 9.8 CRITICAL. The vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reads as network reachable, low attack complexity, no privileges and no user interaction. Impact on confidentiality is high, on integrity high, and on availability high.
How to check if you're exposed
- See which version you have installed.
pip show picklescan
pip list 2>/dev/null | grep -i picklescan
- Search your repositories and CI configuration for picklescan, including requirements files and pipeline steps that gate model downloads.
grep -rni "picklescan" requirements*.txt pyproject.toml .github 2>/dev/null
- Check whether other tools bundle picklescan as a dependency. Model hubs and internal registries sometimes use it behind the scenes.
- Review past scan results for archives that produced an error or an empty report. Under the affected versions, those may have gone unscanned.
What to do now
- Upgrade to picklescan 0.0.31 or later.
pip install --upgrade "picklescan>=0.0.31"
- Re-scan model files you scanned before upgrading, especially any that reported errors or no findings.
- Change your pipeline so a scanner error blocks the download. Fail closed, not open.
- Prefer model formats that do not execute code on load, such as safetensors, where the model supplies one.
- Load models from sources you trust, and pin the exact file hash you reviewed.
- Add picklescan to your dependency inventory so you hear about the next advisory. The free in-browser dependency scan and the Gold directory show which known issues sit in the components you ship.
Why it matters
Python pickle files can run code when they are loaded. That is a feature of the format, which is why people scan model files before using them. A scanner is a safety control, and a safety control that fails quietly is worse than none, because it gives a false sense of safety.
Here the control stopped on an error and returned no results, and a pipeline that reads "no results" as "clean" would pass the file. The fix is to handle the broken archive the same way the loader would. For your own pipelines, the lesson is to treat any scanner failure as a failed check. The record is not flagged by CISA as exploited in the wild, and I found no statement of exploitation in the advisory.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which picklescan version fixes CVE-2025-10156?
Version 0.0.31, according to the maintainer's GitHub advisory. Versions up to 0.0.30 are affected.
Why is an empty scan result dangerous?
Because a scanner that halts on an error can report nothing, and a pipeline may read nothing as clean. Make scanner errors fail the build.
Sources
- picklescan GitHub security advisory GHSA-mjqp-26hc-grxg
- NVD record for CVE-2025-10156
Last reviewed: 19 October 2026.
