Fickling is intended to detect unsafe deserialization by analyzing Python pickles. In versions up to 0.1.6 the tool incorrectly classifies pickles that invoke Python’s runpy module—specifically runpy.run_path() or runpy.run_module()—as merely suspicious, not overtly malicious. An attacker can embed these calls within a malicious pickle; if an environment trusts Fickling’s markings and proceeds to deserialize such a file, the runpy calls will execute attacker‑controlled code, providing full code execution on the system.

The vulnerability affects the Python package Fickling from the Trail of Bits vendor. All releases up to and including 0.1.6 are impacted. The fix is available in 0.1.7 and later versions.

The CVSS score is 8.9, indicating high severity, while the EPSS score is below 1%, suggesting a very low probability of exploitation in the wild at the time of analysis. The vulnerability is not currently listed in the CISA KEV catalog. An attacker would craft a malicious pickle that triggers runpy execution; if a system trusts Fickling’s classification and deserializes the payload, arbitrary code execution is achieved. The attack vector requires delivery of a crafted pickle to the target, typically via file ingestion or network transfer, but does not rely on other infrastructure or privileged access.