By vendor

Mmaitre314 vulnerabilities

Known CVEs affecting Mmaitre314 products, prioritized by severity, with SEC.co remediation and detection guidance.

4 published vulnerabilities

• CVE-2025-71348HIGH 8.1

  A vulnerability in picklescan, a Python library designed to detect malicious pickle files, allows attackers to bypass its safety checks by embedding code that specifically leverages torch.utils._config_module.load_config within pickle reduce methods. When an unsuspecting user loads such a crafted pickle file, the embedded code executes as if the file were benign, potentially giving attackers a foothold in supply chain scenarios where picklescan is relied upon as a gatekeeper.

• CVE-2025-71357HIGH 8.1

  Picklescan, a Python library designed to detect malicious pickle files, has a detection bypass vulnerability in versions before 0.0.30. Attackers can craft pickle files that leverage Python's idlelib.pyshell.ModifiedInterpreter.runcommand function within reduce methods to execute arbitrary remote commands on systems that load the file. The vulnerability exists because picklescan fails to recognize this specific code execution path as dangerous, allowing malicious payloads to slip through security checks.

• CVE-2025-71378HIGH 8.1

  picklescan is a security tool designed to detect malicious code hidden in Python pickle files before they're loaded. A vulnerability in picklescan versions before 0.0.30 allows attackers to hide malicious code using the cProfile.runctx function in ways the tool fails to recognize. When a user thinks they're safely loading a scanned pickle file, the malicious code executes anyway, potentially giving attackers full control of the system. The vulnerability requires user interaction—someone must actually load the pickle file—but once they do, the attacker can run arbitrary commands.

• CVE-2026-56304MEDIUM 6.5

  Picklescan, a Python security tool, has a vulnerability in versions before 1.0.1 that allows attackers to craft malicious pickle payloads to create arbitrary zero-byte files on affected systems without authentication. While the vulnerability cannot directly execute code, it can be weaponized to create lock files or filesystem artifacts that disrupt application functionality. This attack is possible because the tool doesn't properly validate pickle data before deserializing it, a known dangerous practice in Python. An attacker only needs network access to send a crafted pickle payload to an application using a vulnerable version of picklescan.