CVE-2025-10157
A Protection Mechanism Failure vulnerability in mmaitre314 picklescan versions up to and including 0.0.30 allows a remote attacker to bypass the unsafe globals check. This is possible because the scanner performs an exact match for module names, allowing malicious payloads to be loaded via submodules of dangerous packages (e.g., 'asyncio.unix_events' instead of 'asyncio'). When the incorrectly considered safe file is loaded after scan, it can lead to the execution of malicious code.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.3
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.79%
- CWE
- CWE-693
- Published
- 2025-09-17
- Last modified
- 2026-03-12
Affected products
- mmaitre314 picklescan
Weakness type
Related vulnerabilities
- CVE-2026-54694 — NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover
- CVE-2026-79638 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
- CVE-2026-87808 — SiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlock
- CVE-2026-78552 — Validation Bypass in Okta Access Gateway Custom Directives
- CVE-2026-81376 — Visual Studio Code Security Feature Bypass Vulnerability
- CVE-2026-77892 — Windows Boot Manager Elevation of Privilege Vulnerability
- CVE-2026-84811 — agentverus-scanner Companion Code Analysis Bypass via Excluded Python Bytecode
- CVE-2026-84810 — claude-skill-antivirus Analysis Bypass via Manifest-Only Local Directory Scan