fickling EUVD-2026-41675

Exploitation requires that the victim use a vulnerable fickling version (≤ 0.1.10) to scan or load an attacker-controlled pickle - the pickle must import one of the three un-denylisted stdlib modules (_posixsubprocess for fork_exec, site for execsitecustomize, or atexit for _run_exitfuncs) to achieve code execution while still receiving a LIKELY_SAFE verdict. Reliable bypass of the UnusedVariables heuristic additionally depends on the SETITEMS opcode pattern noted in the advisory. The limiting factor is the required user interaction (CVSS UI:R): the attack only fires when someone actively runs fickling's safety check or fickling.load() on the malicious file, so no exploitation occurs against a host that never processes the hostile pickle; no authentication is needed (PR:N) and the vector is network-deliverable since the pickle can be distributed as a model file.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) reflects a network-deliverable, low-complexity, unauthenticated attack that requires user interaction - specifically, a victim must scan or load an attacker-supplied pickle with fickling. That user-interaction requirement is the primary limiter: this is not a wormable remote-service flaw but a defense bypass that fires when the defensive tool itself processes hostile input, which is precisely fickling's intended use case (analyzing untrusted ML model files), so the UI:R condition is easily satisfied in practice. No EPSS score, KEV listing, or POC flag is present in the provided intelligence, so exploitation probability cannot be quantified from the data; the detailed public advisory (GHSA-m6fh-58r7-x697) and named exploit primitives nonetheless lower the barrier to weaponization even though no exploit code is confirmed. This is a genuine priority for anyone relying on fickling as a security gate, because a false LIKELY_SAFE verdict actively converts a protective control into an execution path - but it is not evidence of widespread active exploitation. No SSVC decision data was supplied.

An attacker publishes a malicious ML model (e.g., a PyTorch/pickle artifact) to a model hub or supplies it to a victim who uses fickling to vet untrusted pickles. The victim runs fickling.load() or check_safety() on the file; because the payload uses _posixsubprocess.fork_exec, fickling reports LIKELY_SAFE and then deserializes it, executing an arbitrary binary on the victim's host. No public exploit code is identified at time of analysis, but the advisory names the exact bypass primitives, making weaponization straightforward.