CVE-2025-67747

HIGH EPSS 14.6%
Published Dec 16, 20256mo ago · Modified Jun 17, 20262w ago
7.1 CVSS 4.0
High
Find Similar
Published Dec 16, 2025 6mo ago
Last Modified Jun 17, 2026 2w ago

Description

Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 are missing `marshal` and `types` from the block list of unsafe module imports. Fickling started blocking both modules to address this issue. This allows an attacker to craft a malicious pickle file that can bypass fickling since it misses detections for `types.FunctionType` and `marshal.loads`. A user who deserializes such a file, believing it to be safe, would inadvertently execute arbitrary code on their system. This impacts any user or system that uses Fickling to vet pickle files for security issues. The issue was fixed in version 0.1.6.

CVSS Details

Base Score
7.1
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction P
Scope X

Threat Intelligence

EPSS Exploit Probability
14.6% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 2

CWE-184
CWE-502 Deserialization of Untrusted Data Validation

Affected Products 1

VendorProductVersionRange
trailofbitsfickling* <0.1.6

References 4

  • github.com https://github.com/trailofbits/fickling/commit/4e34561301bda1450268d1d7b0b2b151de33b913
    Patch
  • github.com https://github.com/trailofbits/fickling/pull/186
    Issue Tracking
  • github.com https://github.com/trailofbits/fickling/releases/tag/v0.1.6
    Release Notes
  • github.com https://github.com/trailofbits/fickling/security/advisories/GHSA-565g-hwwr-4pp3
    ExploitThird Party Advisory

Remediation

  • github.com https://github.com/trailofbits/fickling/commit/4e34561301bda1450268d1d7b0b2b151de33b913
    Patch