Which versions of Fickling are affected by CVE-2025-67748?

Trail of Bits Fickling, a Python pickle security scanner, fails to detect malicious pickles in versions before 0.1.6, allowing crafted files to be reported as safe and later executed on the…. A patch is available.

Is there a public PoC exploit available for CVE-2025-67748?

Yes, a public proof-of-concept exploit is available for CVE-2025-67748. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2025-67748?

Within 24 hours, identify all deployments of Trail of Bits Fickling in CI/CD pipelines, developer workstations, and security analysis environments, and upgrade to version 0.1.6 or later; if immediate upgrade is not feasible, disable Fickling as a security gate and treat all pickle files as untrusted. Within 7 days, re-scan any pickle files previously processed by vulnerable versions with the patched tool or an alternative analyzer, and review system logs for signs of unauthorized code execution. Within 30 days, implement sandboxing for pickle deserialization, restrict pickle usage to trusted sources, and conduct a review of reliance on Fickling for security decisions. Note that publicly available exploit code exists, but no confirmed active exploitation has been reported via CISA KEV; the vendor-released patch is 0.1.6.

Fickling CVE-2025-67748

Q: What is the CVSS score of CVE-2025-67748?

CVE-2025-67748 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

HIGH

Code Injection (CWE-94)

2025-12-16 security-advisories@github.com

RCE Python Code Injection Fickling

7.1

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

7.1 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

AV:L and UI:R because a victim must obtain and deserialize a crafted pickle file; PR:N as no authentication is needed; C/I/A:H since successful bypass leads to full code execution on the victim host.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Oct 07, 2026 - 19:38 vuln.today

CVE Published

Dec 16, 2025 - 01:15 cve.org

HIGH 7.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on fickling (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 0.1.6.

DescriptionCVE.org

Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 had a bypass caused by pty missing from the block list of unsafe module imports. This led to unsafe pickles based on pty.spawn() being incorrectly flagged as LIKELY_SAFE, and was fixed in version 0.1.6. This impacted any user or system that used Fickling to vet pickle files for security issues.

AnalysisAI

Trail of Bits Fickling versions before 0.1.6 fail to flag malicious pickles as unsafe because the pty module was omitted from the tool's blocklist of dangerous imports, allowing a crafted pickle that invokes pty.spawn() to be reported as LIKELY_SAFE. The bypass matters in any workflow where a user, analyst, or CI pipeline uses Fickling as a security gate and then unpickles a file it has cleared, resulting in arbitrary code execution on the machine doing the deserialization; the CVSS 4.0 base score is 7.1 (AV:L/AC:L/AT:N/PR:N/UI:P with high confidentiality, integrity and availability impact), reflecting a local, high-impact outcome gated by passive user interaction rather than remote reach. Publicly available exploit code exists, there is no indication of confirmed in-the-wild exploitation (the issue is not listed in CISA KEV), and a vendor fix is available in 0.1.6.

Technical ContextAI

Fickling is a static analyzer and decompiler for Python pickle streams that flags opcodes capable of arbitrary code execution, such as REDUCE, OBJ, INST and STACK_GLOBAL, and warns when dangerous modules are referenced. The root cause is CWE-94 (Code Injection) arising from an incomplete denylist: the analyzer's unsafe-import list omitted pty, so a pickle that builds the global pty.spawn, pushes the argument 'id', and issues REDUCE was not marked unsafe and the file was classified as LIKELY_SAFE. The original report also described a complementary evasion of the unused-variable heuristic, where a trailing BUILD opcode (adding a __setstate__ to the otherwise unused value left on the pickle VM stack) makes the leftover result appear 'used' and further defeats detection. The fix (PR #108 and PR #187) simply adds "pty" to the block list in fickling/fickle.py and extends the test hook to validate that a payload such as cpty\nspawn\nS"id"\no. is now caught. Because the underlying approach is heuristic, the CPE string cpe:2.3:a:trailofbits:fickling:*:*:*:*:*:*:*:* reflects all releases below the patched 0.1.6 boundary; Fickling itself never executes the pickle, so compromise occurs only if the operator acts on the false LIKELY_SAFE verdict and subsequently unpickles the file.

RemediationAI

Upgrade Fickling to version 0.1.6 or later, which adds pty to the unsafe-module block list via https://github.com/trailofbits/fickling/pull/187 (complementing the earlier https://github.com/trailofbits/fickling/pull/108), and verify the fix by confirming that a pty.spawn pickle is now reported as unsafe. If upgrading immediately is not possible, treat Fickling's LIKELY_SAFE output as advisory only and never unpickle a file solely on that basis: run unpickling under a hardened restricted unpickler or in a disposable, network-isolated sandbox with no credentials mounted, and add pty (and other process-spawning modules such as os, subprocess, posix, nt) to any local copy of the block list - accepting that this manual patch is a stopgap that must be maintained as new bypasses appear. Because Fickling's detection is heuristic, the durable control is to avoid pickle for untrusted data entirely and to gate any deserialization step behind an allowlist-based unpickler rather than a denylist, recognizing such restrictions may break legitimate workflows that depend on executing arbitrary pickle payloads. Consult the vendor advisory at https://github.com/trailofbits/fickling/security/advisories/GHSA-r7v6-mfhq-g3m2 for the authoritative fix reference; note that no vendor patch identifier other than the 0.1.6 release and the two pull requests is available in the source data.