{"data":{"id":"b377306b-1fd1-4192-8b59-fae7ef6b5d36","title":"GHSA-mhc9-48gj-9gp3: Fickling has safety check bypass via REDUCE+BUILD opcode sequence","summary":"The Fickling pickle analyzer's five safety interfaces (is_likely_safe(), check_safety(), the --check-safety CLI flag, always_check_safety(), and the check_safety() context manager) report LIKELY_SAFE for pickle files that call dangerous stdlib functions when a REDUCE opcode is followed by a BUILD opcode. The reporter shows this enables a backdoor network listener, process persistence, outbound exfiltration via smtplib.SMTP, and file creation, and that appending a trivial BUILD opcode eliminates detection. Affected versions are all versions through 0.1.7.","solution":"The source states: \"It is believed that the analysis pass works as intended, `REDUCE` and `BUILD` are not at fault here. The few potentially unsafe modules have been added to the blocklist (https://github.com/trailofbits/fickling/commit/0c4558d950daf70e134090573450ddcedaf10400).\"","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-mhc9-48gj-9gp3","publishedAt":"2026-02-25T15:24:18.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["supply_chain","other"],"issueType":"vulnerability","affectedPackages":["fickling@<= 0.1.7 (fixed: 0.1.8)"],"affectedPackageNames":["fickling"],"affectedPackageRefs":["pypi:fickling"],"affectedVendors":["HuggingFace"],"affectedVendorsRaw":["Fickling","pickle"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-mhc9-48gj-9gp3"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":null,"fixReleasedAt":"2026-02-21T00:57:24.820Z","daysToFix":-4,"fixCheckedAt":"2026-10-29T21:40:34.622Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","safety"],"aiComponentTargeted":"model","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[{"ecosystem":"pypi","name":"fickling","fixedVersion":"0.1.8","matchedVersion":"0.1.8","fixReleasedAt":"2026-02-21T00:57:24.820Z","daysToFix":-4,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:40:34.475Z"}]}}