GHSA-mhc9-48gj-9gp3: Fickling has safety check bypass via REDUCE+BUILD opcode sequence

Summary

The Fickling pickle analyzer's five safety interfaces (is_likely_safe(), check_safety(), the --check-safety CLI flag, always_check_safety(), and the check_safety() context manager) report LIKELY_SAFE for pickle files that call dangerous stdlib functions when a REDUCE opcode is followed by a BUILD opcode. The reporter shows this enables a backdoor network listener, process persistence, outbound exfiltration via smtplib.SMTP, and file creation, and that appending a trivial BUILD opcode eliminates detection. Affected versions are all versions through 0.1.7.

Mitigation

The source states: "It is believed that the analysis pass works as intended, `REDUCE` and `BUILD` are not at fault here. The few potentially unsafe modules have been added to the blocklist (https://github.com/trailofbits/fickling/commit/0c4558d950daf70e134090573450ddcedaf10400)."

Topics

• Model and package supply chain

Related items

• HighCVE-2026-119120: Crawl4AI Docker API lets clients choose the HuggingFace model it loadsSame vendor · NVD/CVE Database
• HighGHSA-wf6j-7hvr-gr93: Hydra legacy target blacklist permits unsafe PyYAML loadingSame vendor · Hugging Face Security Advisories
• MediumCVE-2026-100653: vLLM unpinned Hugging Face artifact loads for FunAudioChat and Tarsier2Same vendor · NVD/CVE Database
• HighGHSA-3hmm-rh5q-gwwr: LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loadingSame vendor · Hugging Face Security Advisories
• MediumCVE-2026-80047: Hugging Face Transformers writes remote Python files to disk before trust checkSame vendor · NVD/CVE Database