Fickling is a Python pickling decompiler and static analyzer that inspects pickle files for unsafe imports. Prior to version 0.1.7 the static analyzer’s unsafe_imports() function fails to flag several high-risk Python modules, allowing malicious pickles to import these modules without detection. This defect enables attackers to bypass Fickling’s primary safety checks, potentially leading to arbitrary code execution when the analyzer proceeds with decompilation of untrusted pickle data.

All installed instances of trailofbits fickling older than version 0.1.7 are vulnerable. The issue affects the unsafe_imports() component of the static analysis engine, regardless of the environment or operating system, as long as the vulnerable version is in use.

The CVSS score is 8.9, indicating a high severity failure to execute code. The EPSS score is less than 1%, suggesting exploitation is unlikely at this moment, and the vulnerability is not listed in the CISA KEV catalog. The most probable attack vector is the supply or execution of a malicious pickle file that imports high-risk modules; the attacker can then rely on the analyzer to overlook the danger and potentially execute the embedded code. The risk is mitigated by the fix in version 0.1.7, after which safe_imports() properly blocks high-risk imports.