CVE-2026-118938

Fickling dotted attribute resolution bypasses analysis

Trail of Bits · Fickling pickle and ML model security tooling

First documented disclosure · Review checkpoint

Summary

A dotted class-method reference can pass the safety check and reach code execution during loading.

Severity and exploitation evidence

High · 8.8/10 · CVSS 3.1. Severity source.

Exploitation not established: Controlled research or code-path evidence; the reviewed sources do not establish malicious exploitation or a confirmed victim.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Pickle resolves a dotted STACK_GLOBAL name through an attribute path, but Fickling tracks only the leading import and misses the trailing method call.

Conditions required

A crafted pickle is loaded through fickling.load; the demonstrated optparse.Values.read_file path also needs a readable file containing the code it executes.

Potential impact

Code execution with the deserializing process privileges. The example method remains available across current CPython 3.x versions according to the researcher CNA.

Affected versions and configurations

Fickling through 0.1.12; the researcher also reports the vector survives master snapshot d011709 on October 30.

Fix and mitigation status

No fixed release or complete fix for this specific vector verified as of November 1.

Practical next steps

Avoid deserializing untrusted pickle on the basis of a scanner verdict. Use non-executable serialization where possible and isolate necessary loading; require an issue-specific vendor fix.

Operating lesson

Static security analysis must model the same attribute-resolution semantics as the loader.

Evidence and limits

The dated CNA disclosure is October 30. This is separately fixable from CVE-2026-16760. The June 0.1.12 release mentions another dotted-name fix, but the current CNA explicitly reports this public-method path remains exploitable; that older fix is not assumed to cover this CVE.

Sources