This vulnerability occurs because older versions of the Fickling utility do not flag Python's cProfile.run() as unsafe. As a result, a malicious pickle that uses cProfile.run() is mistakenly classified as SUSPICIOUS rather than OVERTLY_MALICIOUS. If an organization relies on Fickling as a gatekeeper before deserializing pickles, this misclassification can trick users into accepting unsafe payloads, enabling the attacker to execute arbitrary code on the target system.

The affected product is Fickling by Trail of Bits. Versions up to and including 0.1.6 are vulnerable. Affected deployments include any environment where Fickling is used to pre‑screen or analyze pickles before deserialization.

The vulnerability has a CVSS score of 8.9, indicating a high severity impact. The EPSS score is below 1%, suggesting low current exploit probability, and it is not listed in the CISA KEV catalog. However, if an attacker can supply a malicious pickle to an environment that trusts Fickling’s output, they can trigger the embedded cProfile.run() call and gain remote code execution capability. The likely attack vector involves delivering a crafted pickle through user‑controlled input or insecure communication channels that are processed by Fickling.