« Volver al listado

CVE-2025-1716

Estado: ModificadaMedia (5.3)—

picklescan before 0.0.21 does not treat 'pip' as an unsafe global. An attacker could craft a malicious model that uses Pickle to pull in a malicious PyPI package (hosted, for example, on pypi.org or GitHub) via `pip.main()`. Because pip is not a restricted global, the model, when scanned with picklescan, would pass security checks and appear to be safe, when it could instead prove to be problematic.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mmaitre314 — Picklescan

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-1716",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-1716",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-26T15:49:26.250624Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "103e4ec9-0a87-450b-af77-479448ddef11",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 5.3,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "PASSIVE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "103e4ec9-0a87-450b-af77-479448ddef11",
      "affectedData": [
        {
          "repo": "https://github.com/mmaitre314/picklescan",
          "vendor": "mmaitre314",
          "product": "picklescan",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.1",
              "versionType": "semver",
              "lessThanOrEqual": "0.0.20"
            }
          ],
          "collectionURL": "https://pypi.org/project/picklescan/",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-02-26T15:15:24.653",
  "references": [
    {
      "url": "https://github.com/mmaitre314/picklescan/commit/78ce704227c51f070c0c5fb4b466d92c62a7aa3d",
      "tags": [
        "Patch"
      ],
      "source": "103e4ec9-0a87-450b-af77-479448ddef11"
    },
    {
      "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-655q-fx9r-782v",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "103e4ec9-0a87-450b-af77-479448ddef11"
    },
    {
      "url": "https://www.sonatype.com/security-advisories/cve-2025-1716",
      "source": "103e4ec9-0a87-450b-af77-479448ddef11"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "103e4ec9-0a87-450b-af77-479448ddef11",
      "description": [
        {
          "lang": "en",
          "value": "CWE-184"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "picklescan before 0.0.21 does not treat 'pip' as an unsafe global. An attacker could craft a malicious model that uses Pickle to pull in a malicious PyPI package (hosted, for example, on pypi.org or GitHub) via `pip.main()`. Because pip is not a restricted global, the model, when scanned with picklescan, would pass security checks and appear to be safe, when it could instead prove to be problematic."
    },
    {
      "lang": "es",
      "value": "Las versiones anteriores a la versión 0.0.21 de picklescan no tratan a 'pip' como una variable global insegura. Un atacante podría manipular un modelo malicioso que use Pickle para incorporar un paquete PyPI malicioso (alojado, por ejemplo, en pypi.org o GitHub) a través de `pip.main()`. Debido a que pip no es una variable global restringida, el modelo, al analizarse con picklescan, pasaría los controles de seguridad y parecería ser seguro, cuando en realidad podría resultar problemático."
    }
  ],
  "lastModified": "2026-06-17T08:39:39.370",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mmaitre314:picklescan:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A932F445-B2D1-431D-B3CD-937CFB9523BD",
              "versionEndExcluding": "0.0.22"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "103e4ec9-0a87-450b-af77-479448ddef11"
}