Vulnerabilities

Filters

2 selected

9 records

Sort

Vendor: trailofbits Component: Fickling Clear all filters

TI-2026-12265 CVE-2026-14535 · GHSA-mgx3-9w7v-8674

Fickling MLAllowlist analysis pass rendered inoperative by shared mutable state in AnalysisContext.shorten_code()

HIGH 76

In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unconditionally calls AnalysisContext.shorten_code(node) on every import node it inspects, regardless of whether the import…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00564 Published 2026-07-04 Partial fix · 0.1.12 CWE-693

TI-2026-12264 CVE-2026-14534 · GHSA-v8cr-9jrc-fwf9

Fickling check_safety() bypass via unlisted standard library modules (_posixsubprocess, site, atexit)

HIGH 73

Trail of Bits fickling versions up to and including 0.1.10 do not include the Python standard library modules _posixsubprocess, site, and atexit in the UNSAFE_IMPORTS denylist (fickle.py).

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00594 Published 2026-07-04 Partial fix · 0.1.11 CWE-184

TI-2026-18173 CVE-2026-22612 · GHSA-h4rm-mm56-xf63

Fickling vulnerable to detection bypass due to "builtins" blindness

HIGH 80

Fickling is a Python pickling decompiler and static analyzer.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00321 Published 2026-01-10 Fixed in 0.1.7 CWE-502

TI-2026-18170 CVE-2026-22609 · GHSA-q5qq-mvfm-j35x

Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist

HIGH 80

Fickling is a Python pickling decompiler and static analyzer.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00629 Published 2026-01-10 Fixed in 0.1.7 CWE-184

TI-2026-18169 CVE-2026-22608 · GHSA-5hvc-6wx8-mvv4

Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection

HIGH 80

Fickling is a Python pickling decompiler and static analyzer.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00393 Published 2026-01-10 Fixed in 0.1.7 CWE-184

TI-2026-18168 CVE-2026-22607 · GHSA-p523-jq9w-64x9

Fickling Blocklist Bypass: cProfile.run()

HIGH 80

Fickling is a Python pickling decompiler and static analyzer.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00522 Published 2026-01-10 Fixed in 0.1.7 CWE-184

TI-2026-18167 CVE-2026-22606 · GHSA-wfq2-52f7-7qvj

Fickling has a bypass via runpy.run_path() and runpy.run_module()

HIGH 80

Fickling is a Python pickling decompiler and static analyzer.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00482 Published 2026-01-10 Fixed in 0.1.7 CWE-184

TI-2025-41444 CVE-2025-67748 · GHSA-r7v6-mfhq-g3m2

Fickling has Code Injection vulnerability via pty.spawn()

HIGH 66

Fickling is a Python pickling decompiler and static analyzer.

CVSS 4.0HIGH 7.1 Local No auth User interaction EPSS 0.0027 Published 2025-12-16 Fixed in 0.1.6 CWE-184

TI-2025-41443 CVE-2025-67747 · GHSA-565g-hwwr-4pp3

Fickling has missing detection for marshal.loads and types.FunctionType in unsafe modules list

HIGH 66

Fickling is a Python pickling decompiler and static analyzer.

CVSS 4.0HIGH 7.1 Local No auth User interaction EPSS 0.00278 Published 2025-12-16 Fixed in 0.1.6 CWE-184