A check_safety() bypass in Trail of Bits fickling 0.1.12 allows a crafted pickle carrying a dotted __qualname__ such as "Values.read_file" to resolve to a class method instead of a module-level function. The resolver treats the path as a plain import, never flagging the trailing attribute as a call, so check_safety() reports LIKELY_SAFE. When the malicious pickle is loaded via fickling.load(), the code execution function optparse.Values.read_file is invoked, executing arbitrary code supplied by the attacker. This flaw is a serialization deserialization vulnerability (CWE‑502) with an access‑control failure (CWE‑706).

The affected product is Trail of Bits fickling, version 0.1.12. The vulnerability is exercised against Python’s optparse module, which remains available in all current CPython 3.x releases. The flaw is present in the vendor’s master branch as of commit d011709.

The CVSS score of 8.8 indicates high severity. EPSS is not provided, and the vulnerability is not listed in the CISA KEV catalog, so public exploitation data is unknown. The likely attack vector is an attacker supplying a malicious pickle file to a system that calls fickling.load(); the bypass occurs during the safety gate, triggering arbitrary code execution. The risk is significant for any deployment that processes untrusted pickle data with this library.