{"data":{"id":"c2399123-9713-4310-a4fd-1a6c575d767e","title":"GHSA-mxhj-88fx-4pcv: Fickling: OBJ opcode call invisibility bypasses all safety checks","summary":"Fickling's OBJ, NEWOBJ and NEWOBJ_EX opcode handlers push calls onto the interpreter stack without persisting them to the AST via new_variable(). When a result is discarded with POP, the call disappears from the AST, so all five safety interfaces report LIKELY_SAFE for pickles that invoke dangerous stdlib functions such as smtplib.SMTP. Affected versions run through 0.1.7.","solution":"The source states a fix: the interpreter was changed so it behaves closer to CPython when dealing with OBJ, NEWOBJ, and NEWOBJ_EX opcodes (commit ff423dade2bb1f72b2b48586c022fac40cbd9a4a).","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-mxhj-88fx-4pcv","publishedAt":"2026-02-24T21:41:31.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["supply_chain","other"],"issueType":"vulnerability","affectedPackages":["fickling@< 0.1.8 (fixed: 0.1.8)"],"affectedPackageNames":["fickling"],"affectedPackageRefs":["pypi:fickling"],"affectedVendors":[],"affectedVendorsRaw":["Fickling"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-mxhj-88fx-4pcv"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":null,"fixReleasedAt":"2026-02-21T00:57:24.820Z","daysToFix":-3,"fixCheckedAt":"2026-10-29T21:40:39.225Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality","safety"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[{"ecosystem":"pypi","name":"fickling","fixedVersion":"0.1.8","matchedVersion":"0.1.8","fixReleasedAt":"2026-02-21T00:57:24.820Z","daysToFix":-3,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:40:39.078Z"}]}}