GHSA-83pf-v6qq-pwmr: Fickling has a detection bypass via stdlib network-protocol constructors
- Identifier
- GHSA-83pf-v6qq-pwmr
- Published
- Record updated
- Affected
- fickling <= 0.1.7
- Fixed in
- No fixed version was stated when the source was last read.
Summary
Fickling's check_safety() API and --check-safety CLI flag rate as LIKELY_SAFE pickle files that open outbound TCP connections at deserialization time through stdlib constructors such as smtplib.SMTP, imaplib.IMAP4, ftplib.FTP, poplib.POP3, telnetlib.Telnet and nntplib.NNTP. The bypass has two root causes: these modules were missing from the UNSAFE_IMPORTS and UnsafeImportsML.UNSAFE_MODULES blocklists, and an unpatched logic flaw in unused_assignments() at fickle.py:1183 causes variables used only in the final result assignment to be misclassified as unused, letting a BUILD opcode hide the dangerous call from UnusedVariables.
Mitigation
Fixed in PR #233, which adds the six network-protocol modules to UNSAFE_IMPORTS. The unused_assignments() logic flaw at fickle.py:1183 is unpatched in the source; the source does not describe a fix for it.
Related items
- MediumResearchers Uncover Prompt Adware Hidden in OpenAI Codex Jailbreak ToolkitSimilar attack · The Hacker News
- InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
- HighCVE-2026-118627: MLflow SHAP load_explainer untrusted deserialization enables code executionSimilar attack · NVD/CVE Database
- HighCVE-2026-118623: MLflow PickleEvaluationArtifact remote code execution via untrusted pickleSimilar attack · NVD/CVE Database
- HighCVE-2026-88968: Claude Code Edit tool symlink race overwrites files outside workspace on macOSSimilar attack · NVD/CVE Database