Fickling’s failure to block the ctypes and pydoc modules allows attackers to craft pickled objects that trigger a gadget chain. When such data is decompiled or analyzed, the tool can execute arbitrary code while still reporting the file as LIKELY_SAFE, giving the attacker remote code execution on the system where Fickling runs.

Any installation of Trailofbits Fickling older than version 0.1.7 is vulnerable. The patch that blocks ctypes and pydoc was introduced in version 0.1.7, which is the only release that fixes this flaw.

The CVSS score of 8.9 categorizes the issue as high severity, but the EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low current exploitation probability. Nonetheless, because Fickling is used by security analysts and automated pipelines that process pickle files, an attacker who can supply a malicious pickle can activate the gadget chain and gain code execution on the analyst’s machine or any host running the tool. The exploit requires the victim to process crafted pickle data, so it is most relevant when untrusted files are ingested.