{"data":{"id":"5c1c3088-e865-480e-ac47-bba951930392","title":"GHSA-83pf-v6qq-pwmr: Fickling has a detection bypass via stdlib network-protocol constructors","summary":"Fickling's check_safety() API and --check-safety CLI flag rate as LIKELY_SAFE pickle files that open outbound TCP connections at deserialization time through stdlib constructors such as smtplib.SMTP, imaplib.IMAP4, ftplib.FTP, poplib.POP3, telnetlib.Telnet and nntplib.NNTP. The bypass has two root causes: these modules were missing from the UNSAFE_IMPORTS and UnsafeImportsML.UNSAFE_MODULES blocklists, and an unpatched logic flaw in unused_assignments() at fickle.py:1183 causes variables used only in the final result assignment to be misclassified as unused, letting a BUILD opcode hide the dangerous call from UnusedVariables.","solution":"Fixed in PR #233, which adds the six network-protocol modules to UNSAFE_IMPORTS. The unused_assignments() logic flaw at fickle.py:1183 is unpatched in the source; the source does not describe a fix for it.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-83pf-v6qq-pwmr","publishedAt":"2026-02-20T18:24:46.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"low","severity":"low","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["fickling@<= 0.1.7"],"affectedPackageNames":["fickling"],"affectedPackageRefs":["pypi:fickling"],"affectedVendors":[],"affectedVendorsRaw":["Fickling"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-83pf-v6qq-pwmr"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","safety"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[]}}