In Trail of Bits fickling up to version 0.1.12, a flaw in the _process_import() routine assigns an imported name to a set that marks it as likely safe whenever the source module belongs to the standard library and the name is not on an explicit denylist. The tool’s analysis pass then suppresses any call to a function whose name appears in that set, even if the function is itself dangerous. Consequently, any callable reachable through these trusted standard library modules inherits module-level trust, and the safety check reports LIKELY_SAFE with no findings for pickle payloads that exploit the behavior of such callables. The demonstrated primitives—dataclasses._create_fn (executing arbitrary code via exec), mailcap.findmatch (executing commands through os.system), and readline.add_history/write_history_file (writing arbitrary content to a file)—confirm that an attacker can gain remote code execution or file write through a malicious pickle payload.

The issue affects the Trail of Bits fickling library, specifically releases up through 0.1.12. Vulnerable Python standard library modules involved include dataclasses, mailcap, and readline, all of which are present in Python 3.7 through 3.12; the vulnerable behavior was removed in Python 3.13, but the affected fickling versions remain impacted for those Python releases.

The flaw carries a CVSS score of 8.8, indicating high severity, and while the EPSS score is not disclosed, the absence of a KEV listing does not diminish the risk. The attack vector is straightforward: any application that deserializes user-supplied data with fickling.load() can trigger the flawed safety gate, resulting in arbitrary code execution with the privileges of the running process. Because the vulnerability stems from incorrectly inferring safety based on module origin, it can be exploited without the need to bypass traditional authentication or privilege boundaries.