CVE-2026-14534

Fickling missing blocklist entries permit unsafe pickle calls

Trail of Bits · Fickling pickle and ML model security tooling

First documented disclosure · Review checkpoint

Summary

Unlisted standard-library modules can bypass the safety check before pickle loading.

Severity and exploitation evidence

High · 8.8/10 · CVSS 3.1. Severity source.

Exploitation not established: Controlled research or code-path evidence; the reviewed sources do not establish malicious exploitation or a confirmed victim.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The unsafe-import blocklist omitted _posixsubprocess, site and atexit, while standard-library origin caused another analysis pass to skip the calls.

Conditions required

A user or service loads an untrusted pickle through the affected gate; impact depends on callable arguments and platform availability.

Potential impact

Potential code execution through process spawning, local customization code or registered exit callbacks under the loading process privileges.

Affected versions and configurations

Fickling through 0.1.10.

Fix and mitigation status

0.1.11 adds the three blocklist entries for this issue; it does not address the separate later Fickling bypasses.

Practical next steps

Use a supported release with the relevant fixes and isolate untrusted model loading. Do not treat the old issue-specific fix as assurance that all pickle-scanning bypasses are closed.

Operating lesson

Blocklist patches address named gadgets, not the safety of every callable in a module family.

Evidence and limits

Backfill found while reviewing new Fickling disclosures: public fix PR and release May 6, GHSA June 27, CNA July 4. CNA assigns High 8.8 CVSS 3.1 while maintainer labels the advisory Moderate. CNA explicitly maps this GHSA to the CVE despite the GHSA’s stale “No known CVE” field.

Sources