Fickling, a Python pickling decompiler and static analyzer, contains a builtins blindness flaw that allows an attacker to bypass detection mechanisms. This flaw permits the execution of arbitrary code through improperly deserialized pickles. The vulnerability is classified as CWE-502, which describes deserialization of untrusted data leading to unintended code execution.

TrailofBits' Fickling tool is affected, specifically all releases prior to version 0.1.7. Users of any earlier version of Fickling should be aware that the builtins blindness issue could be exploited when processing untrusted pickle data.

The CVSS score of 8.9 highlights high severity, and the EPSS score of less than 1% indicates a low likelihood of exploitation, yet the flaw remains dangerous because it could lead to code execution when Fickling processes external data. The vulnerability is not listed in the CISA KEV catalog. A likely attack vector is local execution by an attacker who supplies or modifies pickle files that Fickling will analyze.