The vulnerability arises because versions of Trail of Bits fickling up to 0.1.10 do not list the Python standard library modules _posixsubprocess, site, and atexit in its UNSAFE_IMPORTS denylist. As a result, fickling’s check_safety() routine returns a LIKELY_SAFE verdict and zero findings for pickle payloads that import these modules. The modules in question expose C‑level functions that can spawn arbitrary processes, execute site customization code, or invoke exit handlers, allowing an attacker to execute arbitrary code when the payload is deserialized. This flaw is a CWE‑184 input validation issue and a CWE‑502 deserialization weakness. The bypass occurs when pickle data is passed to fickling.load(), which chains check_safety() into pickle.loads() as an explicit security gate; a LIKELY_SAFE verdict causes the payload to be deserialized and executed.

The affected product is Trail of Bits fickling. Vulnerable releases include 0.1.10 and all earlier versions. The issue is fixed in version 0.1.11 and later, where the missing modules are added to the UNSAFE_IMPORTS denylist. Any application that uses fickling.load() to deserialize untrusted pickle data while running a vulnerable version is at risk.

The CVSS score of 8.8 indicates high severity, yet the EPSS score of less than 1 % suggests that real‑world exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves delivering a crafted pickle payload that imports one of the missing modules to an application that uses fickling.load(); this causes the payload to be deserialized with a LIKELY_SAFE verdict and the dangerous functions to be executed. The flaw therefore enables arbitrary code execution when the application processes untrusted data.