Vulnerability-Lookup

PYSEC-2025-113

Vulnerability from pysec - Published: 2025-12-16 01:15 - Updated: 2026-05-20 09:19

Details

Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 had a bypass caused by pty missing from the block list of unsafe module imports. This led to unsafe pickles based on pty.spawn() being incorrectly flagged as LIKELY_SAFE, and was fixed in version 0.1.6. This impacted any user or system that used Fickling to vet pickle files for security issues.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Impacted products

Name	purl
fickling	pkg:pypi/fickling

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "fickling",
        "purl": "pkg:pypi/fickling"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.0.1",
        "0.0.2",
        "0.0.3",
        "0.0.4",
        "0.0.5",
        "0.0.6",
        "0.0.7",
        "0.0.8",
        "0.1.2",
        "0.1.3",
        "0.1.4",
        "0.1.5"
      ]
    }
  ],
  "aliases": [
    "CVE-2025-67748",
    "GHSA-r7v6-mfhq-g3m2"
  ],
  "details": "Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 had a bypass caused by `pty` missing from the block list of unsafe module imports. This led to unsafe pickles based on `pty.spawn()` being incorrectly flagged as `LIKELY_SAFE`, and was fixed in version 0.1.6. This impacted any user or system that used Fickling to vet pickle files for security issues.",
  "id": "PYSEC-2025-113",
  "modified": "2026-05-20T09:19:00.310433Z",
  "published": "2025-12-16T01:15:52.950Z",
  "references": [
    {
      "type": "FIX",
      "url": "https://github.com/trailofbits/fickling/pull/108"
    },
    {
      "type": "FIX",
      "url": "https://github.com/trailofbits/fickling/pull/187"
    },
    {
      "type": "EVIDENCE",
      "url": "https://github.com/trailofbits/fickling/security/advisories/GHSA-r7v6-mfhq-g3m2"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2025-67748 (GCVE-0-2025-67748)

Vulnerability from cvelistv5 – Published: 2025-12-16 00:39 – Updated: 2025-12-16 21:12

Title

Fickling has Code Injection vulnerability via pty.spawn()

Summary

Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 had a bypass caused by `pty` missing from the block list of unsafe module imports. This led to unsafe pickles based on `pty.spawn()` being incorrectly flagged as `LIKELY_SAFE`, and was fixed in version 0.1.6. This impacted any user or system that used Fickling to vet pickle files for security issues.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-16 21:10 UTC

CWE

CWE-184 - Incomplete List of Disallowed Inputs
CWE-502 - Deserialization of Untrusted Data
CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7626 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/trailofbits/fickling/security/…	x_refsource_CONFIRM
https://github.com/trailofbits/fickling/pull/108	x_refsource_MISC
https://github.com/trailofbits/fickling/pull/187	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
trailofbits	fickling	Affected: < 0.1.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-67748",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-16T21:10:52.044918Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-16T21:12:34.235Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "fickling",
          "vendor": "trailofbits",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.1.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 had a bypass caused by `pty` missing from the block list of unsafe module imports. This led to unsafe pickles based on `pty.spawn()` being incorrectly flagged as `LIKELY_SAFE`, and was fixed in version 0.1.6. This impacted any user or system that used Fickling to vet pickle files for security issues."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-184",
              "description": "CWE-184: Incomplete List of Disallowed Inputs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502: Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-16T00:39:13.968Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/trailofbits/fickling/security/advisories/GHSA-r7v6-mfhq-g3m2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/trailofbits/fickling/security/advisories/GHSA-r7v6-mfhq-g3m2"
        },
        {
          "name": "https://github.com/trailofbits/fickling/pull/108",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/trailofbits/fickling/pull/108"
        },
        {
          "name": "https://github.com/trailofbits/fickling/pull/187",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/trailofbits/fickling/pull/187"
        }
      ],
      "source": {
        "advisory": "GHSA-r7v6-mfhq-g3m2",
        "discovery": "UNKNOWN"
      },
      "title": "Fickling has Code Injection vulnerability via pty.spawn()"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-67748",
    "datePublished": "2025-12-16T00:39:13.968Z",
    "dateReserved": "2025-12-11T20:30:54.927Z",
    "dateUpdated": "2025-12-16T21:12:34.235Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GHSA-R7V6-MFHQ-G3M2

Vulnerability from github – Published: 2025-12-15 23:37 – Updated: 2026-06-05 17:56

Summary

Fickling has Code Injection vulnerability via pty.spawn()

Details

Fickling Assessment

Based on the test case provided in the original report below, this bypass was caused by pty missing from our block list of unsafe module imports (as previously documented in #108), rather than the unused variable heuristic. This led to unsafe pickles based on pty.spawn() being incorrectly flagged as LIKELY_SAFE, and was fixed in https://github.com/trailofbits/fickling/pull/187.

Original report

Summary

An unsafe deserialization vulnerability in Fickling allows a crafted pickle file to bypass the "unused variable" heuristic, enabling arbitrary code execution. This bypass is achieved by adding a trivial operation to the pickle file that "uses" the otherwise unused variable left on the stack after a malicious operation, tricking the detection mechanism into classifying the file as safe.

Details

Fickling relies on the heuristic of detecting unused variables in the VM's stack after execution. Opcodes like REDUCE, OBJ, and INST, which can be used for arbitrary code execution, leave a value on the stack that is often unused in malicious pickle files. This vulnerability enables a bypass by modifying the pickle file to use this leftover variable. A simple way to achieve this is to add a BUILD opcode that, in effect, adds a __setstate__ to the unused variable. This makes Fickling consider the variable "used," thus failing to flag the malicious file.

PoC

The following is a disassembled view of a malicious pickle file that bypasses Fickling's "unused variable" detection:

    0: \x80 PROTO      4
    2: \x95 FRAME      26
   11: \x8c SHORT_BINUNICODE 'pty'
   16: \x94 MEMOIZE    (as 0)
   17: \x8c SHORT_BINUNICODE 'spawn'
   24: \x94 MEMOIZE    (as 1)
   25: \x93 STACK_GLOBAL
   26: \x94 MEMOIZE    (as 2)
   27: \x8c SHORT_BINUNICODE 'id'
   31: \x94 MEMOIZE    (as 3)
   32: \x85 TUPLE1
   33: \x94 MEMOIZE    (as 4)
   34: R   REDUCE
   35: \x94 MEMOIZE    (as 5)
   36: \x8c SHORT_BINUNICODE 'gottem'
   44: \x94 MEMOIZE    (as 6)
   45: b   BUILD
   46: .   STOP
 ```

Here, the additions to the original pickle file can see on lines 35, 36, 44 and 45.

When analyzing this modified file, Fickling fails to identify it as malicious and reports it as **"LIKELY_SAFE"** as seen here:

{ "severity": "LIKELY_SAFE", "analysis": "Warning: Fickling failed to detect any overtly unsafe code,but the pickle file may still be unsafe.Do not unpickle this file if it is from an untrusted source!\n\n", "detailed_results": {} } ```

Impact

This allows an attacker to craft a malicious pickle file that can bypass fickling since it relies on the "unused variable" heuristic to flag pickle files as unsafe. A user who deserializes such a file, believing it to be safe, would inadvertently execute arbitrary code on their system. This impacts any user or system that uses Fickling to vet pickle files for security issues.

Severity

7.1 (High)


                  
                    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "fickling"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-67748"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-184",
      "CWE-502",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-15T23:37:28Z",
    "nvd_published_at": "2025-12-16T01:15:52Z",
    "severity": "HIGH"
  },
  "details": "## Fickling Assessment\n\nBased on the test case provided in the original report below, this bypass was caused by `pty` missing from our block list of unsafe module imports (as previously documented in #108), rather than the unused variable heuristic. This led to unsafe pickles based on `pty.spawn()` being incorrectly flagged as `LIKELY_SAFE`, and was fixed in https://github.com/trailofbits/fickling/pull/187. \n\n## Original report\n\n### Summary\nAn unsafe deserialization vulnerability in Fickling allows a crafted pickle file to bypass the \"unused variable\" heuristic, enabling arbitrary code execution. This bypass is achieved by adding a trivial operation to the pickle file that \"uses\" the otherwise unused variable left on the stack after a malicious operation, tricking the detection mechanism into classifying the file as safe.\n\n### Details\nFickling relies on the heuristic of detecting unused variables in the VM\u0027s stack after execution. Opcodes like `REDUCE`, `OBJ`, and `INST`, which can be used for arbitrary code execution, leave a value on the stack that is often unused in malicious pickle files.\nThis vulnerability enables a bypass by modifying the pickle file to use this leftover variable. A simple way to achieve this is to add a `BUILD` opcode that, in effect, adds a `__setstate__` to the unused variable. This makes Fickling consider the variable \"used,\" thus failing to flag the malicious file.\n\n### PoC\nThe following is a disassembled view of a malicious pickle file that bypasses Fickling\u0027s \"unused variable\" detection:\n```\n    0: \\x80 PROTO      4\n    2: \\x95 FRAME      26\n   11: \\x8c SHORT_BINUNICODE \u0027pty\u0027\n   16: \\x94 MEMOIZE    (as 0)\n   17: \\x8c SHORT_BINUNICODE \u0027spawn\u0027\n   24: \\x94 MEMOIZE    (as 1)\n   25: \\x93 STACK_GLOBAL\n   26: \\x94 MEMOIZE    (as 2)\n   27: \\x8c SHORT_BINUNICODE \u0027id\u0027\n   31: \\x94 MEMOIZE    (as 3)\n   32: \\x85 TUPLE1\n   33: \\x94 MEMOIZE    (as 4)\n   34: R   REDUCE\n   35: \\x94 MEMOIZE    (as 5)\n   36: \\x8c SHORT_BINUNICODE \u0027gottem\u0027\n   44: \\x94 MEMOIZE    (as 6)\n   45: b   BUILD\n   46: .   STOP\n ```\n \nHere, the additions to the original pickle file can see on lines 35, 36, 44 and 45.\n\nWhen analyzing this modified file, Fickling fails to identify it as malicious and reports it as **\"LIKELY_SAFE\"** as seen here:\n```\n{\n    \"severity\": \"LIKELY_SAFE\",\n    \"analysis\": \"Warning: Fickling failed to detect any overtly unsafe code,but the pickle file may still be unsafe.Do not unpickle this file if it is from an untrusted source!\\n\\n\",\n    \"detailed_results\": {}\n}\n```\n\n### Impact\nThis allows an attacker to craft a malicious pickle file that can bypass fickling since it relies on the \"unused variable\" heuristic to flag pickle files as unsafe. A user who deserializes such a file, believing it to be safe, would inadvertently execute arbitrary code on their system. This impacts any user or system that uses Fickling to vet pickle files for security issues.",
  "id": "GHSA-r7v6-mfhq-g3m2",
  "modified": "2026-06-05T17:56:00Z",
  "published": "2025-12-15T23:37:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/trailofbits/fickling/security/advisories/GHSA-r7v6-mfhq-g3m2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67748"
    },
    {
      "type": "WEB",
      "url": "https://github.com/trailofbits/fickling/pull/108"
    },
    {
      "type": "WEB",
      "url": "https://github.com/trailofbits/fickling/pull/187"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/fickling/PYSEC-2025-113.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/trailofbits/fickling"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Fickling has Code Injection vulnerability via pty.spawn()"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

PYSEC-2025-113

CVE-2025-67748 (GCVE-0-2025-67748)

GHSA-R7V6-MFHQ-G3M2

Fickling Assessment

Original report

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour