fickling CVE-2026-118938

Exploitation requires the victim to run fickling (through 0.1.12, and the current master at commit d011709) as a trust gate - invoking fickling.load() or check_safety() on an attacker-supplied pickle and acting on its verdict. The crafted pickle must use a dotted __qualname__ that names a code-executing class method reachable via pickle's find_class/_getattribute (the advisory's concrete example is optparse.Values.read_file, available because optparse ships in all current CPython 3.x releases and is only deprecated, not removed, as of 3.13). No authentication is needed (PR:N) and the bypass works against default behavior - no special fickling configuration is required beyond relying on its LIKELY_SAFE result. The principal limiting factor is UI:R: the attack only fires when a victim actively loads/scans the malicious pickle through fickling, so environments that do not route untrusted pickles through fickling's safety check are not exposed by this specific weakness.

Severity is rated CVSS 8.8 (HIGH) with vector AV:N/AC:L/PR:N/UI:R, and CWE-706 (incorrectly-resolved name). The key framing: this is a detection-bypass flaw in a security tool, so the real-world harm is a false 'LIKELY_SAFE' verdict that causes a victim to load an attacker-controlled pickle they believed was vetted. The vuln.today decision label is 'this_week' - a near-term priority, not act_now/emergency. Exploitation signals are partly missing: no CISA KEV listing is present in the input, no EPSS probability was provided, and no confirmed working exploit code is referenced (only a third-party advisory from the reporter). These absences should not be read as 'low risk' - they are simply unmeasured here. The notable aggravating factor is persistence of the defect: the input states the bypass was verified still present on vendor master at commit d011709 as of 2026-10-30, surviving the October blocklist additions and the new private-stdlib-attribute heuristic (because optparse.Values.read_file is a public method, neither blocklisted nor private). So there is no complete fix available at analysis time, which raises practical concern for anyone using fickling as a gate. Net: a genuine this-week priority for fickling-dependent pipelines, tempered by the fact that it requires the victim to run fickling on hostile input (UI:R) and that no active-exploitation or EPSS evidence is available to confirm widespread targeting.

An attacker crafts a malicious pickle whose STACK_GLOBAL operand uses a dotted __qualname__ such as 'optparse.Values.read_file', then submits it into a workflow that relies on fickling to screen untrusted pickles (for example an ML model-scanning pipeline). Fickling's check_safety() records only the leading name, renders it as a benign import, returns LIKELY_SAFE with zero findings, and fickling.load() then chains into pickle.loads(), causing optparse.Values.read_file to run exec(open(filename).read(), vars) and execute attacker-controlled code. No confirmed working exploit code is referenced in the input; a third-party advisory describing the technique exists.