Fickling CVE-2025-67747

Fickling, maintained by Trail of Bits, is a Python pickle decompiler and static analyzer that inspects pickle bytecode (opcodes such as STACK_GLOBAL, REDUCE, and BUILD) to flag dangerous constructs before a file is ever deserialized. Its safety checks work largely by maintaining a block list of unsafe module/attribute names that can be reached through STACK_GLOBAL; when a payload references any of those names, Fickling raises the reported severity above LIKELY_SAFE. Before 0.1.6 that list was missing 'marshal' and 'types', so two powerful primitives went undetected: marshal.loads, which turns attacker-supplied bytes into a live Python code object, and types.FunctionType, which wraps that code object into a callable function. The advisory PoC chains these with pickle REDUCE opcodes - marshal.loads(code_bytes) followed by types.FunctionType(code, globals), then a final REDUCE with an empty argument tuple - to build and invoke a function that runs os.system('id'). This is a classic CWE-184 incomplete-block-list defect: the detection logic is sound in principle but its deny-list is not exhaustive, so the analyzer emits a false-negative 'LIKELY_SAFE' verdict. Fickling itself is not the execution sink; the arbitrary code runs only in the victim's process at the later unpickling step, when the crafted file is actually loaded. The fix in commit 4e34561301bda1450268d1d7b0b2b151de33b913 adds 'marshal' and 'types' to the unsafe-import set in fickling/fickle.py.