picklescan bypass via non-standard file extensions (CVE-2025-1889)
Date: 2025
Affected: picklescan <0.0.22
Attack vector: supply-chain
Category: vulnerability-disclosure
Severity: High

picklescan <0.0.22 only considers standard pickle file extensions; an attacker can hide a malicious pickle file with a non-standard extension.


Mitigations:

Architectural layers (MAESTRO):