picklescan bypass via 'pip main' (CVE-2025-1716)
Date: 2025
Affected: picklescan <0.0.21
Attack vector: supply-chain
Category: vulnerability-disclosure
Severity: High

picklescan <0.0.21 does not treat 'pip' as an unsafe global. An attacker can craft a malicious model that uses Pickle to pull in a malicious PyPI package via pip.main().


Mitigations:

Architectural layers (MAESTRO):