CVE-2025-10156

Katalog CVE

CVSS 9.8 · Critical EPSS 1,5%

Kerentanan Improper Handling of Exceptional Conditions pada mmaitre314 picklescan. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

An Improper Handling of Exceptional Conditions vulnerability in the ZIP archive scanning component of mmaitre314 picklescan allows a remote attacker to bypass security scans. This is achieved by crafting a ZIP archive containing a file with a bad Cyclic Redundancy Check (CRC), which causes the scanner to halt and fail to analyze the contents for malicious pickle files. When the file incorrectly considered safe is loaded, it can lead to the execution of malicious code.

Rincian

Terbit di NVD

17 September 2025

Terakhir diubah

26 September 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-755: Improper Handling of Exceptional Conditions

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 73,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mmaitre314/picklescan/security/advisories/GHSA-mjqp-26hc-grxg exploit · advisory vendor
• https://github.com/mmaitre314/picklescan/blob/v0.0.29/src/picklescan/relaxed_zipfile.py#L35 product
• https://huggingface.co/jinaai/jina-embeddings-v2-base-en/resolve/main/pytorch_model.bin?download=true not applicable
• https://huggingface.co/jinaai/jina-embeddings-v2-base-en/tree/main not applicable