Tob

Fickling, a Python pickling decompiler and static analyzer, incorrectly classifies pickles utilizing Python’s `runpy.run path()` or `runpy.run module()` as SUSPICIOUS instead of OVERTLY MALICIOUS. This misclassification can occur when a user relies on Fickling’s output to determine the safety of pickle deserialization, potentially leading to the execution of attacker-controlled code. This issue impacts any workflow or product that uses Fickling as a security gate for pickle deserialization.

Fickling, a Python pickling decompiler and static analyzer, incorrectly classifies pickles utilizing the `cProfile.run()` function as SUSPICIOUS instead of OVERTLY MALICIOUS. This misclassification can lead users to execute attacker-controlled code if they rely on Fickling’s output to determine pickle safety for deserialization. This issue impacts any workflow or product using Fickling as a security gate for pickle deserialization.