Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/36978?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/36978?format=api", "vulnerability_id": "VCID-nvvk-8a8j-43gw", "summary": "picklescan before 0.0.21 does not treat 'pip' as an unsafe global. An attacker could craft a malicious model that uses Pickle to pull in a malicious PyPI package (hosted, for example, on pypi.org or GitHub) via `pip.main()`. Because pip is not a restricted global, the model, when scanned with picklescan, would pass security checks and appear to be safe, when it could instead prove to be problematic.", "aliases": [ { "alias": "CVE-2025-1716" }, { "alias": "CVE-2025-1889" }, { "alias": "GHSA-655q-fx9r-782v" }, { "alias": "PYSEC-2025-18" }, { "alias": "PYSEC-2025-19" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/44411?format=api", "purl": "pkg:pypi/picklescan@0.0.21", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2syv-syp1-6yhk" }, { "vulnerability": "VCID-ag3v-g92v-kbde" }, { "vulnerability": "VCID-auku-kbg2-2ybg" }, { "vulnerability": "VCID-avk4-jaz6-m3gw" }, { "vulnerability": "VCID-jfcq-vpg2-pkdn" }, { "vulnerability": "VCID-nvvk-8a8j-43gw" }, { "vulnerability": "VCID-w2h9-74te-tqhc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/picklescan@0.0.21" }, { "url": "http://public2.vulnerablecode.io/api/packages/44475?format=api", "purl": "pkg:pypi/picklescan@0.0.22", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2syv-syp1-6yhk" }, { "vulnerability": "VCID-ag3v-g92v-kbde" }, { "vulnerability": "VCID-auku-kbg2-2ybg" }, { "vulnerability": "VCID-avk4-jaz6-m3gw" }, { "vulnerability": "VCID-jfcq-vpg2-pkdn" }, { "vulnerability": "VCID-w2h9-74te-tqhc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/picklescan@0.0.22" } ], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/44391?format=api", "purl": "pkg:pypi/picklescan@0.0.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2syv-syp1-6yhk" }, { "vulnerability": "VCID-ag3v-g92v-kbde" }, { "vulnerability": "VCID-auku-kbg2-2ybg" }, { "vulnerability": "VCID-avk4-jaz6-m3gw" }, { "vulnerability": "VCID-jfcq-vpg2-pkdn" }, { "vulnerability": "VCID-nvvk-8a8j-43gw" }, { "vulnerability": "VCID-w2h9-74te-tqhc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/picklescan@0.0.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/44392?format=api", "purl": "pkg:pypi/picklescan@0.0.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2syv-syp1-6yhk" }, { "vulnerability": "VCID-ag3v-g92v-kbde" }, { "vulnerability": "VCID-auku-kbg2-2ybg" }, { "vulnerability": "VCID-avk4-jaz6-m3gw" }, { "vulnerability": "VCID-jfcq-vpg2-pkdn" }, { "vulnerability": "VCID-nvvk-8a8j-43gw" }, { "vulnerability": "VCID-w2h9-74te-tqhc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/picklescan@0.0.2" }, { "url": "http://public2.vulnerablecode.io/api/packages/44393?format=api", "purl": "pkg:pypi/picklescan@0.0.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2syv-syp1-6yhk" }, { "vulnerability": "VCID-ag3v-g92v-kbde" }, { "vulnerability": "VCID-auku-kbg2-2ybg" }, { "vulnerability": "VCID-avk4-jaz6-m3gw" }, { "vulnerability": "VCID-jfcq-vpg2-pkdn" }, { "vulnerability": "VCID-nvvk-8a8j-43gw" }, { "vulnerability": "VCID-w2h9-74te-tqhc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/picklescan@0.0.3" }, { "url": "http://public2.vulnerablecode.io/api/packages/44394?format=api", "purl": "pkg:pypi/picklescan@0.0.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2syv-syp1-6yhk" }, { "vulnerability": "VCID-ag3v-g92v-kbde" }, { "vulnerability": "VCID-auku-kbg2-2ybg" }, { "vulnerability": "VCID-avk4-jaz6-m3gw" }, { "vulnerability": "VCID-jfcq-vpg2-pkdn" }, { "vulnerability": "VCID-nvvk-8a8j-43gw" }, { "vulnerability": "VCID-w2h9-74te-tqhc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/picklescan@0.0.4" }, { "url": "http://public2.vulnerablecode.io/api/packages/44395?format=api", "purl": "pkg:pypi/picklescan@0.0.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2syv-syp1-6yhk" }, { "vulnerability": "VCID-ag3v-g92v-kbde" }, { "vulnerability": "VCID-auku-kbg2-2ybg" }, { "vulnerability": "VCID-avk4-jaz6-m3gw" }, { "vulnerability": "VCID-jfcq-vpg2-pkdn" }, { "vulnerability": "VCID-nvvk-8a8j-43gw" }, { "vulnerability": "VCID-w2h9-74te-tqhc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/picklescan@0.0.5" }, { "url": "http://public2.vulnerablecode.io/api/packages/44396?format=api", "purl": "pkg:pypi/picklescan@0.0.6", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2syv-syp1-6yhk" }, { "vulnerability": "VCID-ag3v-g92v-kbde" }, { "vulnerability": "VCID-auku-kbg2-2ybg" }, { "vulnerability": "VCID-avk4-jaz6-m3gw" }, { "vulnerability": "VCID-jfcq-vpg2-pkdn" }, { "vulnerability": "VCID-nvvk-8a8j-43gw" }, { "vulnerability": "VCID-w2h9-74te-tqhc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/picklescan@0.0.6" }, { "url": "http://public2.vulnerablecode.io/api/packages/44397?format=api", "purl": "pkg:pypi/picklescan@0.0.7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2syv-syp1-6yhk" }, { "vulnerability": "VCID-ag3v-g92v-kbde" }, { "vulnerability": "VCID-auku-kbg2-2ybg" }, { "vulnerability": "VCID-avk4-jaz6-m3gw" }, { "vulnerability": "VCID-jfcq-vpg2-pkdn" }, { "vulnerability": "VCID-nvvk-8a8j-43gw" }, { "vulnerability": "VCID-w2h9-74te-tqhc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/picklescan@0.0.7" }, { "url": "http://public2.vulnerablecode.io/api/packages/44398?format=api", "purl": "pkg:pypi/picklescan@0.0.8", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2syv-syp1-6yhk" }, { "vulnerability": "VCID-ag3v-g92v-kbde" }, { "vulnerability": "VCID-auku-kbg2-2ybg" }, { "vulnerability": "VCID-avk4-jaz6-m3gw" }, { "vulnerability": "VCID-jfcq-vpg2-pkdn" }, { "vulnerability": "VCID-nvvk-8a8j-43gw" }, { "vulnerability": "VCID-w2h9-74te-tqhc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/picklescan@0.0.8" }, { "url": "http://public2.vulnerablecode.io/api/packages/44399?format=api", "purl": "pkg:pypi/picklescan@0.0.9", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2syv-syp1-6yhk" }, { "vulnerability": "VCID-ag3v-g92v-kbde" }, { "vulnerability": "VCID-auku-kbg2-2ybg" }, { "vulnerability": "VCID-avk4-jaz6-m3gw" }, { "vulnerability": "VCID-jfcq-vpg2-pkdn" }, { "vulnerability": "VCID-nvvk-8a8j-43gw" }, { "vulnerability": "VCID-w2h9-74te-tqhc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/picklescan@0.0.9" }, { "url": "http://public2.vulnerablecode.io/api/packages/44400?format=api", "purl": "pkg:pypi/picklescan@0.0.10", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2syv-syp1-6yhk" }, { "vulnerability": "VCID-ag3v-g92v-kbde" }, { "vulnerability": "VCID-auku-kbg2-2ybg" }, { "vulnerability": "VCID-avk4-jaz6-m3gw" }, { "vulnerability": "VCID-jfcq-vpg2-pkdn" }, { "vulnerability": "VCID-nvvk-8a8j-43gw" }, { "vulnerability": "VCID-w2h9-74te-tqhc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/picklescan@0.0.10" }, { "url": "http://public2.vulnerablecode.io/api/packages/44401?format=api", "purl": "pkg:pypi/picklescan@0.0.11", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2syv-syp1-6yhk" }, { "vulnerability": "VCID-ag3v-g92v-kbde" }, { "vulnerability": "VCID-auku-kbg2-2ybg" }, { "vulnerability": "VCID-avk4-jaz6-m3gw" }, { "vulnerability": "VCID-jfcq-vpg2-pkdn" }, { "vulnerability": "VCID-nvvk-8a8j-43gw" }, { "vulnerability": "VCID-w2h9-74te-tqhc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/picklescan@0.0.11" }, { "url": "http://public2.vulnerablecode.io/api/packages/44402?format=api", "purl": "pkg:pypi/picklescan@0.0.12", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2syv-syp1-6yhk" }, { "vulnerability": "VCID-ag3v-g92v-kbde" }, { "vulnerability": "VCID-auku-kbg2-2ybg" }, { "vulnerability": "VCID-avk4-jaz6-m3gw" }, { "vulnerability": "VCID-jfcq-vpg2-pkdn" }, { "vulnerability": "VCID-nvvk-8a8j-43gw" }, { "vulnerability": "VCID-w2h9-74te-tqhc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/picklescan@0.0.12" }, { "url": "http://public2.vulnerablecode.io/api/packages/44403?format=api", "purl": "pkg:pypi/picklescan@0.0.13", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2syv-syp1-6yhk" }, { "vulnerability": "VCID-ag3v-g92v-kbde" }, { "vulnerability": "VCID-auku-kbg2-2ybg" }, { "vulnerability": "VCID-avk4-jaz6-m3gw" }, { "vulnerability": "VCID-jfcq-vpg2-pkdn" }, { "vulnerability": "VCID-nvvk-8a8j-43gw" }, { "vulnerability": "VCID-w2h9-74te-tqhc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/picklescan@0.0.13" }, { "url": "http://public2.vulnerablecode.io/api/packages/44404?format=api", "purl": "pkg:pypi/picklescan@0.0.14", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2syv-syp1-6yhk" }, { "vulnerability": "VCID-ag3v-g92v-kbde" }, { "vulnerability": "VCID-auku-kbg2-2ybg" }, { "vulnerability": "VCID-avk4-jaz6-m3gw" }, { "vulnerability": "VCID-jfcq-vpg2-pkdn" }, { "vulnerability": "VCID-nvvk-8a8j-43gw" }, { "vulnerability": "VCID-w2h9-74te-tqhc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/picklescan@0.0.14" }, { "url": "http://public2.vulnerablecode.io/api/packages/44405?format=api", "purl": "pkg:pypi/picklescan@0.0.15", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2syv-syp1-6yhk" }, { "vulnerability": "VCID-ag3v-g92v-kbde" }, { "vulnerability": "VCID-auku-kbg2-2ybg" }, { "vulnerability": "VCID-avk4-jaz6-m3gw" }, { "vulnerability": "VCID-jfcq-vpg2-pkdn" }, { "vulnerability": "VCID-nvvk-8a8j-43gw" }, { "vulnerability": "VCID-w2h9-74te-tqhc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/picklescan@0.0.15" }, { "url": "http://public2.vulnerablecode.io/api/packages/44406?format=api", "purl": "pkg:pypi/picklescan@0.0.16", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2syv-syp1-6yhk" }, { "vulnerability": "VCID-ag3v-g92v-kbde" }, { "vulnerability": "VCID-auku-kbg2-2ybg" }, { "vulnerability": "VCID-avk4-jaz6-m3gw" }, { "vulnerability": "VCID-jfcq-vpg2-pkdn" }, { "vulnerability": "VCID-nvvk-8a8j-43gw" }, { "vulnerability": "VCID-w2h9-74te-tqhc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/picklescan@0.0.16" }, { "url": "http://public2.vulnerablecode.io/api/packages/44407?format=api", "purl": "pkg:pypi/picklescan@0.0.17", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2syv-syp1-6yhk" }, { "vulnerability": "VCID-ag3v-g92v-kbde" }, { "vulnerability": "VCID-auku-kbg2-2ybg" }, { "vulnerability": "VCID-avk4-jaz6-m3gw" }, { "vulnerability": "VCID-jfcq-vpg2-pkdn" }, { "vulnerability": "VCID-nvvk-8a8j-43gw" }, { "vulnerability": "VCID-w2h9-74te-tqhc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/picklescan@0.0.17" }, { "url": "http://public2.vulnerablecode.io/api/packages/44408?format=api", "purl": "pkg:pypi/picklescan@0.0.18", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2syv-syp1-6yhk" }, { "vulnerability": "VCID-ag3v-g92v-kbde" }, { "vulnerability": "VCID-auku-kbg2-2ybg" }, { "vulnerability": "VCID-avk4-jaz6-m3gw" }, { "vulnerability": "VCID-jfcq-vpg2-pkdn" }, { "vulnerability": "VCID-nvvk-8a8j-43gw" }, { "vulnerability": "VCID-w2h9-74te-tqhc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/picklescan@0.0.18" }, { "url": "http://public2.vulnerablecode.io/api/packages/44409?format=api", "purl": "pkg:pypi/picklescan@0.0.19", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2syv-syp1-6yhk" }, { "vulnerability": "VCID-ag3v-g92v-kbde" }, { "vulnerability": "VCID-auku-kbg2-2ybg" }, { "vulnerability": "VCID-avk4-jaz6-m3gw" }, { "vulnerability": "VCID-jfcq-vpg2-pkdn" }, { "vulnerability": "VCID-nvvk-8a8j-43gw" }, { "vulnerability": "VCID-w2h9-74te-tqhc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/picklescan@0.0.19" }, { "url": "http://public2.vulnerablecode.io/api/packages/44410?format=api", "purl": "pkg:pypi/picklescan@0.0.20", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2syv-syp1-6yhk" }, { "vulnerability": "VCID-ag3v-g92v-kbde" }, { "vulnerability": "VCID-auku-kbg2-2ybg" }, { "vulnerability": "VCID-avk4-jaz6-m3gw" }, { "vulnerability": "VCID-jfcq-vpg2-pkdn" }, { "vulnerability": "VCID-nvvk-8a8j-43gw" }, { "vulnerability": "VCID-w2h9-74te-tqhc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/picklescan@0.0.20" }, { "url": "http://public2.vulnerablecode.io/api/packages/44411?format=api", "purl": "pkg:pypi/picklescan@0.0.21", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2syv-syp1-6yhk" }, { "vulnerability": "VCID-ag3v-g92v-kbde" }, { "vulnerability": "VCID-auku-kbg2-2ybg" }, { "vulnerability": "VCID-avk4-jaz6-m3gw" }, { "vulnerability": "VCID-jfcq-vpg2-pkdn" }, { "vulnerability": "VCID-nvvk-8a8j-43gw" }, { "vulnerability": "VCID-w2h9-74te-tqhc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/picklescan@0.0.21" } ], "references": [ { "reference_url": "https://github.com/mmaitre314/picklescan/commit/78ce704227c51f070c0c5fb4b466d92c62a7aa3d", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/mmaitre314/picklescan/commit/78ce704227c51f070c0c5fb4b466d92c62a7aa3d" }, { "reference_url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-655q-fx9r-782v", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-655q-fx9r-782v" }, { "reference_url": "https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-1716", "reference_id": "", "reference_type": "", "scores": [], "url": "https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-1716" }, { "reference_url": "https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-1889", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-1889" } ], "weaknesses": [], "exploits": [], "severity_range_score": "9.8 - 9.8", "exploitability": null, "weighted_severity": null, "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-nvvk-8a8j-43gw" }