In versions of Trail of Bits Fickling up to 0.1.11, the UnsafeImportsML analysis pass registers every import node with a shared reported_shortened_code set regardless of whether the import is flagged unsafe. The following MLAllowlist pass then sees this set already populated, skips its allowlist check, and becomes effectively inert. As a result, imports of modules that are not in the UnsafeImports denylist—including standard library modules—can be executed when pickle data is deserialized via fickling.load(). This bypass of the safety gate allows an attacker to achieve arbitrary code execution through malicious pickle payloads, violating the integrity and confidentiality of the system. The flaw is an instance of improper control of resource location (CWE‑693).

Trail of Bits Fickling versions 0.1.0 through 0.1.11 are affected. Any Python application that utilizes fickling.load() to deserialize untrusted pickle data is at risk.

The CVSS score of 8.8 categorizes the vulnerability as high severity for remote code execution. The EPSS score of less than 1% indicates a low probability of active exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an attacker supplying crafted pickle payloads to an application using fickling.load(), allowing execution of arbitrary code without requiring elevated system privileges.