---
id: CVE-2025-10157
title: >-
  A Protection Mechanism Failure vulnerability in mmaitre314 picklescan versions
  up to and including 0.0.30 allows a remote attacker to bypass the unsafe
  globals check
summary: >-
  A Protection Mechanism Failure vulnerability in mmaitre314 picklescan versions
  up to and including 0.0.30 allows a remote attacker to bypass the unsafe
  globals check. This is possible because the scanner performs an exact match
  for modul…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-693
vendor: mmaitre314
product: picklescan
affected:
  - picklescan < 0.0.31
patched:
  - picklescan 0.0.31
published: '2025-09-17'
updated: '2026-09-26'
sourceUpdated: '2026-09-26T00:10:00.127'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-10157'
references:
  - url: >-
      https://github.com/mmaitre314/picklescan/blob/2a8383cfeb4158567f9770d86597300c9e508d0f/src/picklescan/scanner.py#L309
    label: reefs@jfrog.com
  - url: >-
      https://github.com/mmaitre314/picklescan/security/advisories/GHSA-f7qq-56ww-84cr
    label: reefs@jfrog.com
  - url: >-
      https://huggingface.co/iluem/linux_pkl/resolve/main/asyncio_asyncio_unix_events___UnixSubprocessTransport__start.pkl
    label: reefs@jfrog.com
tags:
  - nvd
epss: 0.00789
epssPercentile: 0.54367
ingestedAt: '2026-09-26T00:22:39.927Z'
---

## Overview

A Protection Mechanism Failure vulnerability in mmaitre314 picklescan versions up to and including 0.0.30 allows a remote attacker to bypass the unsafe globals check. This is possible because the scanner performs an exact match for module names, allowing malicious payloads to be loaded via submodules of dangerous packages (e.g., 'asyncio.unix_events' instead of 'asyncio'). 

When the incorrectly considered safe file is loaded after scan, it can lead to the execution of malicious code.

## Affected

- `picklescan < 0.0.31`

## Remediation

Upgrade past the affected range:

- `picklescan 0.0.31`