CVE-2025-67747

Name of the Vulnerable Software and Affected Versions Fickling versions prior to 0.1.6

Description Fickling, a Python pickling decompiler and static analyzer, lacks marshal and types in its list of blocked unsafe module imports. This allows attackers to create malicious pickle files that bypass Fickling’s security checks, specifically by utilizing types.FunctionType and marshal.loads. Deserializing these files can lead to arbitrary code execution on the system. This affects any user or system relying on Fickling to assess the security of pickle files.

Recommendations Versions prior to 0.1.6 should be updated to version 0.1.6 or later.