Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-10156

Good to know:

icon

Date: September 17, 2025

An Improper Handling of Exceptional Conditions vulnerability in the ZIP archive scanning component of mmaitre314 picklescan allows a remote attacker to bypass security scans. This is achieved by crafting a ZIP archive containing a file with a bad Cyclic Redundancy Check (CRC), which causes the scanner to halt and fail to analyze the contents for malicious pickle files. When the file incorrectly considered safe is loaded, it can lead to the execution of malicious code.

Severity Score

Related Resources (8)

https://huggingface.co/jinaai/jina-embeddings-v2-base-en/tree/main
https://github.com/mmaitre314/picklescan
https://github.com/mmaitre314/picklescan/commit/28a7b4ef753466572bda3313737116eeb9b4e5c5
https://github.com/mmaitre314/picklescan/blob/v0.0.29/src/picklescan/relaxed_zipfile.py#L35
https://huggingface.co/jinaai/jina-embeddings-v2-base-en/resolve/main/pytorch_model.bin?download=true
https://nvd.nist.gov/vuln/detail/CVE-2025-10156
https://github.com/mmaitre314/picklescan/security/advisories/GHSA-mjqp-26hc-grxg
https://www.mend.io/vulnerability-database/CVE-2025-10156

Severity Score

Weakness Type (CWE)

Protection Mechanism Failure

CWE-693

Improper Handling of Exceptional Conditions

CWE-755

Top Fix

icon

Upgrade Version

Upgrade to version picklescan - 0.0.31

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): HIGH

Do you need more information?

Contact Us