Trail of Bits fickling 0.1.12 and earlier versions have a security check bypass vulnerability that can lead to arbitrary code execution
In Trail of Bits fickling through 0.1.12, a pickle...
Trail of Bits' pickle security analysis tool fickling has a security check bypass vulnerability in 0.1.12 and earlier versions (CVE-2026-118938); a malicious pickle can achieve arbitrary code execution when check_safety() returns LIKELY_SAFE. A STACK_GLOBAL operand with a dotted qualified name (such as Values.read_file) is resolved by pickle's find_class via _getattribute to an arbitrary attribute path, while fickling only records the first segment of the name in import tracking and renders it as an ordinary import; the trailing attribute reference is not analyzed as a call, and OvertlyBadEvals does not flag it either.
A malicious pickle uses a dotted attribute path to bypass fickling's security checks and achieve arbitrary code execution; teams that rely on check_safety to scan pickles can use this to review the trustworthiness of scan results.