Dev

[davidka91]

No description provided.

[davidka91]

📗 Scan Summary

• Frogbot scanned for violations and found 5 issues

Scan Category	Status	Security Issues
Software Composition Analysis	✅ Done	5 Issues Found 1 Critical 4 High
Contextual Analysis	✅ Done	-
Static Application Security Testing (SAST)	✅ Done	Not Found
Secrets	✅ Done	-
Infrastructure as Code (IaC)	✅ Done	Not Found

🚥 Policy Violations

🚨 Security Violations

Severity	ID	Contextual Analysis	Direct Dependencies	Impacted Dependency	Watch Name
Critical	CVE-2025-10156	Not Covered	picklescan:0.0.24	picklescan:0.0.24	frogbot
High	-	Undetermined	picklescan:0.0.24	picklescan:0.0.24	frogbot
High	CVE-2025-10155	Not Covered	picklescan:0.0.24	picklescan:0.0.24	frogbot
High	CVE-2025-10157	Not Covered	picklescan:0.0.24	picklescan:0.0.24	frogbot
High	CVE-2025-46417	Not Covered	picklescan:0.0.24	picklescan:0.0.24	frogbot

🔖 Details

[ CVE-2025-10156 ] picklescan 0.0.24 (frogbot)

Violation Details

Policies:	high-cve
Watch Name:	frogbot
Contextual Analysis:	Not Covered
Direct Dependencies:	picklescan:0.0.24
Impacted Dependency:	picklescan:0.0.24
Fixed Versions:	[0.0.31]
CVSS V3:	9.8

An Improper Handling of Exceptional Conditions vulnerability in the ZIP archive scanning component of mmaitre314 picklescan allows a remote attacker to bypass security scans. This is achieved by crafting a ZIP archive containing a file with a bad Cyclic Redundancy Check (CRC), which causes the scanner to halt and fail to analyze the contents for malicious pickle files. When the file incorrectly considered safe is loaded, it can lead to the execution of malicious code.

[ XRAY-714109 ] picklescan 0.0.24 (frogbot)

Violation Details

Policies:	high-cve
Watch Name:	frogbot
Contextual Analysis:	Undetermined
Direct Dependencies:	picklescan:0.0.24
Impacted Dependency:	picklescan:0.0.24
Fixed Versions:	[0.0.27]
CVSS V3:	-

Picklescan has pickle parsing logic flaw that leads to malicious pickle file bypass

[ CVE-2025-10155 ] picklescan 0.0.24 (frogbot)

Violation Details

Policies:	high-cve
Watch Name:	frogbot
Contextual Analysis:	Not Covered
Direct Dependencies:	picklescan:0.0.24
Impacted Dependency:	picklescan:0.0.24
Fixed Versions:	[0.0.31]
CVSS V3:	7.8

An Improper Input Validation vulnerability in the scanning logic of mmaitre314 picklescan versions up to and including 0.0.30 allows a remote attacker to bypass pickle files security checks by supplying a standard pickle file with a PyTorch-related file extension. When the pickle file incorrectly considered safe is loaded, it can lead to the execution of malicious code.

[ CVE-2025-10157 ] picklescan 0.0.24 (frogbot)

Violation Details

Policies:	high-cve
Watch Name:	frogbot
Contextual Analysis:	Not Covered
Direct Dependencies:	picklescan:0.0.24
Impacted Dependency:	picklescan:0.0.24
Fixed Versions:	[0.0.31]
CVSS V3:	7.8

A Protection Mechanism Failure vulnerability in mmaitre314 picklescan versions up to and including 0.0.30 allows a remote attacker to bypass the unsafe globals check. This is possible because the scanner performs an exact match for module names, allowing malicious payloads to be loaded via submodules of dangerous packages (e.g., 'asyncio.unix_events' instead of 'asyncio').

When the incorrectly considered safe file is loaded after scan, it can lead to the execution of malicious code.

[ CVE-2025-46417 ] picklescan 0.0.24 (frogbot)

Violation Details

Policies:	high-cve
Watch Name:	frogbot
Contextual Analysis:	Not Covered
Direct Dependencies:	picklescan:0.0.24
Impacted Dependency:	picklescan:0.0.24
Fixed Versions:	[0.0.25]
CVSS V3:	7.5

The unsafe globals in Picklescan before 0.0.25 do not include ssl. Consequently, ssl.get_server_certificate can exfiltrate data via DNS after deserialization.

---

🐸 JFrog Frogbot

[davidka91]

no comment