Trail of Bits fickling up to version 0.1.10 fails to list several core Python modules—_posixsubprocess, site, and atexit—in its UNSAFE_IMPORTS denylist. As a result, the library’s check_safety() routine deems payloads that import these modules as LIKELY_SAFE, allowing the malicious functions in those modules to bypass the safety gate and be executed during deserialization.

The affected product is Trail of Bits fickling. Versions 0.1.10 and any earlier releases are vulnerable. The problem is resolved in version 0.1.11 and later, where the missing modules are added to the denylist. Any application that uses fickling.load() to deserialize untrusted pickle data is at risk while using a vulnerable version.

The CVSS score of 8.8 indicates a high‑severity vulnerability, although the EPSS score of less than 1 % suggests that real‑world exploitation is currently unlikely. The issue is not listed in the CISA KEV catalog. The most probable attack vector is the delivery of a rogue pickle payload to an application that uses fickling.load(); the attacker must supply the malicious data to that process, which then blindly deserializes exposure requires upgrading the library or implementing a stricter deserialization policy.