Christopher Aziz

**Name of the Vulnerable Software and Affected Versions** Trail of Bits fickling versions 0.1.10 and earlier **Description** An improper input validation issue exists in the denylist logic used to analyze pickle opcode imports. The `UNSAFE IMPORTS` denylist in `fickle.py` fails to include critical Python standard library modules, specifically ` posixsubprocess`, `site`, and `atexit`. This allows a crafted malicious pickle payload to bypass the `check safety()` function, which may incorrectly classify the payload as safe. When an application uses the `fickling.load()` API to deserialize this untrusted content, it can lead to arbitrary code execution. This is achieved by invoking dangerous functions such as ` posixsubprocess.fork exec()`, `site.execsitecustomize()`, or `atexit. run exitfuncs()`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, avoid using the `fickling.load()` API to process untrusted pickle content.

**Name of the Vulnerable Software and Affected Versions** Trail of Bits fickling versions prior to 0.1.12 **Description** An issue exists where the `UnsafeImportsML` analysis pass unconditionally calls the `AnalysisContext.shorten code(node)` function on every import node. This action populates a shared `AnalysisContext.reported shortened code` set, which causes the subsequent `MLAllowlist` analysis pass to skip its allowlist checks entirely. Consequently, the `MLAllowlist` pass becomes dead code and fails to identify imports of modules outside the known-safe ML ecosystem. This allows standard library modules not present in the `UNSAFE IMPORTS` denylist to be invoked via pickle deserialization when the `fickling.load()` API calls `check safety()`, which incorrectly returns a `LIKELY SAFE` verdict, leading to the execution of the payload. **Recommendations** Update to a version newer than 0.1.11.