CVE-2025-10157— picklescan 安全漏洞

PickleScan Bypasses Unsafe Globals Check Using Submodule Imports

A Protection Mechanism Failure vulnerability in mmaitre314 picklescan versions up to and including 0.0.30 allows a remote attacker to bypass the unsafe globals check. This is possible because the scanner performs an exact match for module names, allowing malicious payloads to be loaded via submodules of dangerous packages (e.g., 'asyncio.unix_events' instead of 'asyncio'). When the incorrectly considered safe file is loaded after scan, it can lead to the execution of malicious code.

N/A

保护机制失效

picklescan 安全漏洞

picklescan是Matthieu Maitre个人开发者的一个安全扫描程序。 picklescan 0.0.30及之前版本存在安全漏洞，该漏洞源于模块名称检查不充分，可能导致绕过不安全全局检查并执行恶意代码。

N/A

N/A