PT-2025-10575 · Pytorch+1 · Pytorch+1
Madgetr
·
Published
2025-03-10
·
Updated
2025-03-10
·
CVE-2025-1945
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
PickleScan versions prior to 0.0.23
Description
The issue allows an attacker to embed malicious pickle files inside PyTorch model archives by modifying specific ZIP file flag bits. This can lead to arbitrary code execution when loading a compromised model, as the malicious files remain undetected by PickleScan but are successfully loaded by PyTorch's torch.load() function.
Recommendations
For PickleScan versions prior to 0.0.23, update to version 0.0.23 or later to resolve the issue. As a temporary workaround, consider manually inspecting ZIP file headers for modified flag bits before loading PyTorch models. Restrict access to potentially compromised models to minimize the risk of exploitation.
Exploit
Fix
Insufficient Verification of Data Authenticity
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Picklescan
Pytorch