picklescan misses malicious pickles in PyTorch archives (ZIP flag manipulation)
Date: 2025
Affected: picklescan <0.0.23
Attack vector: supply-chain
Category: vulnerability-disclosure
Severity: Critical

picklescan <0.0.23 fails to detect malicious pickle files inside PyTorch model archives when certain ZIP flag bits are modified, allowing arbitrary code execution on torch.load().


Mitigations:

Architectural layers (MAESTRO):