Priority MEDIUM 41
In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example "Values.read_file") is resolved by pickle's find_class through _getattribute to an arbitrary attribute p…
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00478 · Published 2026-10-30 · No fix listed CWE-502
Priority MEDIUM 40
In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the likely_safe_imports set whenever the source module is present in sys.stdlib_module_names and the name is ab…
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00455 · Published 2026-10-30 · No fix listed CWE-502
Priority HIGH 76
In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unconditionally calls AnalysisContext.shorten_code(node) on every import node it inspects, regardless of whether the import…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00564 · Published 2026-07-04 · Partial fix · 0.1.12 CWE-693
Priority HIGH 73
Trail of Bits fickling versions up to and including 0.1.10 do not include the Python standard library modules _posixsubprocess, site, and atexit in the UNSAFE_IMPORTS denylist (fickle.py).
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00594 · Published 2026-07-04 · Partial fix · 0.1.11 CWE-184
Priority HIGH 66
rfc3161-client is a Python library implementing the Time-Stamp Protocol (TSP) described in RFC 3161.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00195 · Published 2026-04-08 · Partial fix · 1.0.6 CWE-295
Priority HIGH 80
Fickling is a Python pickling decompiler and static analyzer.
CVSS 4.0HIGH 8.9· Network · No auth · No interaction · EPSS 0.00321 · Published 2026-01-10 · Fixed in 0.1.7 CWE-502
Priority HIGH 80
Fickling is a Python pickling decompiler and static analyzer.
CVSS 4.0HIGH 8.9· Network · No auth · No interaction · EPSS 0.00629 · Published 2026-01-10 · Fixed in 0.1.7 CWE-184
Priority HIGH 80
Fickling is a Python pickling decompiler and static analyzer.
CVSS 4.0HIGH 8.9· Network · No auth · No interaction · EPSS 0.00393 · Published 2026-01-10 · Fixed in 0.1.7 CWE-184
Priority HIGH 80
Fickling is a Python pickling decompiler and static analyzer.
CVSS 4.0HIGH 8.9· Network · No auth · No interaction · EPSS 0.00522 · Published 2026-01-10 · Fixed in 0.1.7 CWE-184
Priority HIGH 80
Fickling is a Python pickling decompiler and static analyzer.
CVSS 4.0HIGH 8.9· Network · No auth · No interaction · EPSS 0.00482 · Published 2026-01-10 · Fixed in 0.1.7 CWE-184
Priority HIGH 66
Fickling is a Python pickling decompiler and static analyzer.
CVSS 4.0HIGH 7.1· Local · No auth · User interaction · EPSS 0.0027 · Published 2025-12-16 · Fixed in 0.1.6 CWE-184
Priority HIGH 66
Fickling is a Python pickling decompiler and static analyzer.
CVSS 4.0HIGH 7.1· Local · No auth · User interaction · EPSS 0.00278 · Published 2025-12-16 · Fixed in 0.1.6 CWE-184
Priority MEDIUM 47
rfc3161-client is a Python library implementing the Time-Stamp Protocol (TSP) described in RFC 3161.
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00169 · Published 2025-06-21 · Fixed in 1.0.3 CWE-347
Priority MEDIUM 44
uthenticode is a small cross-platform library for partially verifying Authenticode digital signatures.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00574 · Published 2023-08-09 · No fix listed CWE-347
Priority LOW 32
uthenticode is a small cross-platform library for partially verifying Authenticode digital signatures.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00247 · Published 2023-08-09 · Fixed in 2.0.0 CWE-325
THREATIST.IORead the docs