Trail of Bits fickling: check_safety() bypass via dotted __qualname__ in pickle
Summary
Fickling, a Python tool that checks pickle files for malicious content, does not analyze dotted attribute names in pickle STACK_GLOBAL operands. A crafted pickle can reference a class method such as optparse.Values.read_file, which is reported as a plain import and rated LIKELY_SAFE. When such a file is loaded through fickling.load(), the method can execute arbitrary code on the system.
Affected
- Trail of Bits fickling through 0.1.12
- Vendor master branch at commit d011709 (as of 2026-10-30) is also affected according to the CNA
Fixed in
- Unknown. No patched release was found at the time of writing.
Workaround
- Do not rely on fickling.load() or check_safety() as a security boundary for untrusted pickle files.
- Do not load pickle or PyTorch model files from untrusted sources; prefer safetensors or other non-executable formats.
- If pickle loading cannot be avoided, run it in an isolated, low-privilege environment without secrets or network access.
Exploitation
- Not known to be exploited in the wild.
- Public proof of concept: Unknown.
Our recommendation
- Identify any use of fickling (for example with pip show fickling, requirements files and ML pipelines).
- Stop using fickling as the only security gate for pickle files from external sources.
- Restrict where pickle files from third parties can be loaded and isolate such loading.
- Monitor the vendor advisory for a fix, then upgrade and retest.
- The CVSS score is 8.8 (High) according to the CNA; VulDB rates it 4.8 (Medium).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Bombadil Systems advisory bombadil.systems
- fickling GitHub repository github.com
- fickling commit d011709 github.com
- fickling 0.1.12 on PyPI pypi.org
- VulDB entry vuldb.com
- Strix CVE-2026-118938 www.strix.ai
- fickling security advisories github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:37.
Original description (NVD)
In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example "Values.read_file") is resolved by pickle's find_class through _getattribute to an arbitrary attribute path rather than to a module-level function. Fickling records only the leading component of the name in its import tracking and renders the operation as a plain import (for instance, 'python -m fickling' displays it as 'from optparse import Values.read_file'), so the trailing attribute reference is never analyzed as a call. The OvertlyBadEvals analysis pass does not flag it, and check_safety() returns LIKELY_SAFE with zero findings. This allows an attacker to reach a class method that performs code execution: optparse.Values.read_file executes exec(open(filename).read(), vars), achieving arbitrary code execution when the crafted pickle is loaded through fickling.load(), which chains check_safety() into pickle.loads() as an explicit security gate. optparse is present in all current CPython 3.x releases (deprecated as of Python 3.13, not removed). This weakness is in the resolution and analysis of dotted attribute-path names, and is distinct from and independently fixable from the module-origin trust weakness tracked as CVE-2026-16760: resolving or flagging dotted attribute-path imports closes this vector while leaving the module-level trust behavior unchanged. This bypass was verified to remain present on the vendor master branch at commit d011709 as of 2026-10-30, after the vendor's October blocklist additions and a new heuristic that flags private stdlib attributes; because the public class method Values.read_file is neither blocklisted nor flagged as a private attribute, it is not addressed by those remediations.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.