CVE-2025-1889: Critical Scan Bypass in picklescan Before 0.0.22

CVE-2025-1889 is a critical (9.8) weakness in picklescan before 0.0.22, a tool that scans machine learning model files for dangerous pickle content. It only inspected files with standard pickle extensions, so a pickle with another name passed unchecked. Upgrade to 0.0.22 at least, and 0.0.23 or later to also cover CVE-2025-1945.

What's affected

The record names the Python package picklescan, from the project maintained by mmaitre314, in all versions before 0.0.22. The weakness is CWE-646, reliance on the file name or extension of a submitted file. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

The description says an attacker could craft a model that uses pickle and include a malicious pickle file with a non-standard extension. Because that file is outside the scope picklescan considers, it passes the check and appears safe. A related GitHub advisory for the same project, GHSA-655q-fx9r-782v, lists patched version 0.0.22 as well, for a different picklescan bypass.

The record is not on the CISA Known Exploited Vulnerabilities list, and nothing I fetched claims exploitation in the wild.

Fixed versions: 0.0.22 fixes this issue. Version 0.0.23 fixes a later bypass, CVE-2025-1945, so use 0.0.23 or newer.

How to check if you're exposed

Check every place picklescan runs, including CI jobs, model download scripts and any model registry or upload workflow that uses it as a gate.

pip show picklescan
pip list --outdated | grep -i picklescan

In a project with a lock file, search it as well.

grep -rn "picklescan" requirements*.txt poetry.lock Pipfile.lock pyproject.toml

Any version below 0.0.22 is affected. Also look at what the scan result is used for. If a passing scan lets a model into production without any other control, the bypass is a bigger problem for you than the version number.

What to do now

1. Upgrade picklescan to 0.0.23 or later in every environment and rebuild any container image that bundles it.
2. Rescan models that were checked with an older version, and treat a clean result from before the upgrade as unconfirmed.
3. Prefer model formats that do not run code when loaded, such as safetensors, where you can choose the format.
4. When you must load PyTorch files with torch.load, pass weights_only=True so the loader refuses to run arbitrary objects.
5. Load untrusted models in a sandbox without network access or secrets.
6. Pin the scanner version and add the package to your dependency inventory so you hear about the next advisory.

Why it matters

Pickle is a Python serialization format that can run code while it loads. A scanner that tries to spot dangerous content is a useful layer, but it is a list of known bad patterns, and it can only look at files it chooses to read. This weakness is a scope error. The tool decided what to scan by file name, and file names are chosen by whoever supplies the file.

For teams pulling models from public hubs, the lesson is wider than this one version. A scan result is evidence, not a guarantee. Combine it with safer formats, safe loading options and isolation, so one missed file does not become code running on a training or inference host.

Try it yourself

See how an inventory of Python dependencies exposes a scanner version that needs attention.

Click through it at your own pace, or open it full screen.

You can also check a dependency list in your browser with the free dependency scan.

Quick check

Sources

• Sonatype advisory for CVE-2025-1889
• picklescan advisory GHSA-655q-fx9r-782v
• picklescan advisory GHSA-w8jq-xcqf-f792

Last reviewed: 19 October 2026.