CVE-2026-16760
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
fickling through 0.1.12 incorrectly treats calls to functions from Python standard library modules as safe without inspecting their actual behavior. As a result, check_safety() returns LIKELY_SAFE for malicious pickle payloads that reach code execution or file writes through such callables (e.g., dataclasses._create_fn, mailcap.findmatch, readline.write_history_file). Because fickling.load() uses this verdict as a security gate before pickle.loads(), the payload is deserialized and executed with the privileges of the victim process.
Risk Assessment
An organization using fickling to vet untrusted pickle files may be tricked by a malicious payload that is judged safe and then executed. This leads to arbitrary code execution or arbitrary file writes with the privileges of the processing process.
Recommendation
Update fickling to a version containing the fix (commit d011709 or a later official release) and do not rely solely on check_safety() when processing untrusted pickle files. Until the fix is released, consider running deserialization in an isolated environment with limited privileges.
Other vulnerabilities in fickling
See all- CVE-2026-22612High
Fickling, a Python pickling decompiler and static analyzer, before version 0.1.7 contains a vulnerability that allows bypassing detection of malicious code. The issue stems from a lack of analysis of 'builtins' objects and has been fixed in version 0.1.7.
- CVE-2026-22609High
Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, the unsafe_imports() method in Fickling's static analyzer fails to flag several high-risk Python modules that can be used for arbitrary code execution. Malicious pickles importing these modules will not be detected as unsafe, allowing attackers to bypass Fickling's primary static safety checks.
- CVE-2026-22608High
Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, it did not explicitly block the ctypes and pydoc modules, which combined with pydoc.locate can achieve RCE while the scanner still reports the file as LIKELY_SAFE. This issue has been patched in version 0.1.7.
- CVE-2026-22607High
Fickling versions up to and including 0.1.6 do not treat Python's cProfile module as unsafe. A malicious pickle using cProfile.run() is classified as SUSPICIOUS instead of OVERTLY_MALICIOUS, potentially leading to arbitrary code execution.
- CVE-2026-22606High
Fickling versions up to and including 0.1.6 do not treat Python's runpy module as unsafe. A malicious pickle using runpy.run_path() or runpy.run_module() is classified as SUSPICIOUS instead of OVERTLY_MALICIOUS. This can lead to arbitrary code execution if users rely on Fickling's output for deserialization safety.
- CVE-2026-118938High
A vulnerability in Trail of Bits fickling through 0.1.12 allows a pickle STACK_GLOBAL operand with a dotted __qualname__ (e.g., "Values.read_file") to be resolved by pickle's find_class via _getattribute to an arbitrary attribute path instead of a module-level function. Fickling records only the leading component in its import tracking and renders the operation as a plain import, so the trailing attribute reference is never analyzed as a call; the OvertlyBadEvals pass does not flag it and check_safety() returns LIKELY_SAFE with zero findings. This lets an attacker reach a class method that performs code execution (optparse.Values.read_file executes exec(open(filename).read(), vars)), achieving arbitrary code execution when the crafted pickle is loaded through fickling.load(), which chains check_safety() into pickle.loads() as an explicit security gate.
- CVE-2026-14535High
In fickling up to version 0.1.11, the UnsafeImportsML analysis pass registers shortened code for every import in a shared set, causing the subsequent MLAllowlist pass to skip all checks as already reported. This renders MLAllowlist dead code, allowing imports of modules outside the allowlist (e.g., torch, numpy) to be missed, leading to a false LIKELY_SAFE verdict.
- CVE-2026-14534High
The vulnerability in fickling up to version 0.1.10 is due to missing Python standard library modules (_posixsubprocess, site, atexit) in the UNSAFE_IMPORTS denylist. This causes check_safety() to incorrectly mark malicious pickle payloads as LIKELY_SAFE, allowing deserialization and execution of dangerous functions like fork_exec, execsitecustomize, or _run_exitfuncs.
- CVE-2025-67748High
Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 had a bypass caused by `pty` missing from the block list of unsafe module imports. This led to unsafe pickles based on `pty.spawn()` being incorrectly flagged as `LIKELY_SAFE`, and was fixed in version 0.1.6. This impacted any user or system that used Fickling to vet pickle files for security issues.
- CVE-2025-67747High
Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 are missing `marshal` and `types` from the block list of unsafe module imports. Fickling started blocking both modules to address this issue. This allows an attacker to craft a malicious pickle file that can bypass fickling since it misses detections for `types.FunctionType` and `marshal.loads`. A user who deserializes such a file, believing it to be safe, would inadvertently execute arbitrary code on their system. This impacts any user or system that uses Fickling to vet pickle files for security issues. The issue was fixed in version 0.1.6.
Original NVD description (English source)
In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the likely_safe_imports set whenever the source module is present in sys.stdlib_module_names and the name is absent from the UNSAFE_IMPORTS denylist, without inspecting what the name resolves to or how it behaves. The OvertlyBadEvals analysis pass in analysis.py then unconditionally skips any call whose function name appears in likely_safe_imports, including calls that would otherwise be flagged as overtly dangerous. As a result, any callable reachable through a non-blocked standard library module inherits module-level trust regardless of its own behavior, and check_safety() returns LIKELY_SAFE with zero findings for pickle payloads that reach code execution or file write through such callables. Demonstrated primitives: dataclasses._create_fn, which passes an attacker-controlled function body to exec() and yields arbitrary code execution on Python 3.7 through 3.12 (the internal _create_fn function was removed in Python 3.13); mailcap.findmatch, which internally calls os.system() on a test command taken from an attacker-controlled caps dictionary, yielding arbitrary code execution on Python versions through 3.12 (the mailcap module was removed in Python 3.13); and readline.add_history() followed by readline.write_history_file(), which writes attacker-controlled content to an arbitrary filesystem path (POSIX platforms, where the readline module is available). fickling.load() chains check_safety() into pickle.loads() as an explicit security gate, so a LIKELY_SAFE verdict causes the payload to be deserialized and executed with the privileges of the victim process. The root cause is the inference of callable safety from module origin; it is independent of, and separately fixable from, the dotted __qualname__ resolution weakness tracked as CVE-2026-118938, which this advisory does not address. As of 2026-10-30 the three demonstrated modules were added to UNSAFE_IMPORTS on the vendor master branch (commit d011709) pending release; released versions through 0.1.12 remain affected, and the module-origin trust root cause persists, as demonstrated by the related CVE-2026-118938 remaining exploitable on that same build.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS