CVE-2025-1945 is a critical (9.8) flaw in picklescan before 0.0.23. By changing certain bits in a ZIP header, a malicious pickle inside a PyTorch model archive can go undetected by the scanner while PyTorch still loads it. Upgrade to 0.0.23 and treat scans as one layer of defence.
What's affected
The record names picklescan, from the mmaitre314 project, in versions before 0.0.23. The project's GitHub advisory, GHSA-w8jq-xcqf-f792, lists affected versions below 0.0.23 and patched version 0.0.23. The weakness is CWE-345, insufficient verification of data authenticity. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
PyTorch model files are ZIP archives. The advisory explains that picklescan relies on Python's zipfile module to read and scan the contents, and that certain flag bits in the ZIP entry cause that module to raise errors. When the scan fails that way, the file is not inspected. PyTorch's loader ignores those same bits and still loads the model. I am not repeating the proof of concept here.
The record is not on the CISA Known Exploited Vulnerabilities list, and nothing I fetched says it is exploited in the wild.
Fixed versions: 0.0.23.
How to check if you're exposed
Look for picklescan anywhere models are vetted, such as CI pipelines, model download scripts and internal registries.
pip show picklescan
grep -rn "picklescan" requirements*.txt poetry.lock Pipfile.lock pyproject.toml
A version below 0.0.23 is affected. Next, look at how scan errors are handled. A scan that throws an error and then lets the file through is the exact failure the advisory describes, so check that your pipeline fails closed.
What to do now
- Upgrade picklescan to 0.0.23 or later and rebuild images that include it.
- Make your pipeline fail closed. If a scan raises an error or cannot read a file, block the model and flag it for review.
- Rescan models accepted under older versions, especially ones from sources you do not control.
- Load PyTorch files with weights_only=True, or use a format such as safetensors that does not execute code on load.
- Run model loading in an isolated environment with no secrets and no outbound network.
- Track the scanner as a dependency so new advisories reach you.
Why it matters
The scanner and the loader read the same file in different ways. When two programs disagree about what a file contains, an attacker can write a file that looks empty or broken to one and complete to the other. Security researchers call this a parser differential, and it shows up wherever one tool vets what another tool later runs.
The fix in a scanner is to treat any error as a reason to refuse the file. The fix in your pipeline is the same idea at a larger scale. Do not rely on a single check, and make failure the default outcome when a check cannot run.
Quick check
Why does a scan error matter so much here?
Because the bypass works by making the scanner fail while the loader still succeeds. If your process treats a failed scan as a pass, the model gets through without inspection.
Does upgrading picklescan make untrusted models safe?
No. It closes this bypass, but a scanner cannot promise that every unsafe file is caught. Combine it with safe formats, weights_only loading and isolation.
Sources
Last reviewed: 19 October 2026.
