fickling EUVD-2026-41676

Exploitation requires that the victim uses fickling ≤0.1.11 as a security gate-specifically fickling.load() or check_safety()-on an attacker-controlled pickle, and that the malicious payload relies on a module NOT present in fickling's UNSAFE_IMPORTS denylist (e.g., otherwise-benign standard-library imports) that MLAllowlist would normally have rejected. No special fickling configuration or non-default mode is needed: the reported_shortened_code poisoning occurs on every run of the default analysis chain. Limiting factors that reduce real-world risk: the attacker must get the crafted pickle to a system that actually trusts fickling's verdict before deserializing, so environments that never process untrusted pickles, that sandbox deserialization, or that have upgraded to 0.1.12 are not exposed; the CVSS PR:N/UI:N rating treats delivery-and-processing of the untrusted file as inherent to fickling's use case rather than requiring interactive user action.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C/I/A:H = 9.8) reflects the downstream impact-arbitrary code execution via unsafe deserialization-rather than a directly network-reachable bug, since fickling itself is a library whose failure only manifests when a victim runs check_safety()/fickling.load() on an attacker-supplied pickle. SSVC characterizes this precisely: Exploitation 'poc', Automatable 'no', Technical Impact 'total'-total impact but no evidence of scaled, automated exploitation. EPSS is low (0.30%, 22nd percentile) and the CVE is not in CISA KEV, so this is a serious latent supply-chain risk rather than a confirmed mass-exploitation event. The key nuance defenders must weigh: the raw 9.8 assumes the pickle reaches the parser over the network with no privileges, but real exploitation additionally requires that the victim actually relies on fickling as its security gate and processes untrusted pickles-making this a defense-in-depth failure whose real-world severity depends heavily on deployment. No signals conflict; the low EPSS plus 'poc' status are consistent with a freshly disclosed bypass that has a working demonstration but no widespread weaponization yet.

An attacker publishes a malicious ML model (or otherwise supplies a pickle) whose payload imports a standard-library module absent from fickling's UNSAFE_IMPORTS denylist to gain code execution during unpickling. A victim on fickling ≤0.1.11 calls fickling.load() (or check_safety()) as their safety gate; MLAllowlist never evaluates the import, check_safety() returns LIKELY_SAFE, and pickle.loads() runs the payload. Given SSVC 'poc' and the advisory's regression tests demonstrating the bypass, working exploit logic is public, and the AV:N/AC:L profile means no special positioning is needed beyond delivering the file.