CVE-2026-14535

Fickling analysis state silently disables ML import allowlist

Trail of Bits · Fickling MLAllowlist analysis pass

First documented disclosure · Review checkpoint

Summary

Shared analysis bookkeeping can cause the ML import allowlist to skip every import.

Severity and exploitation evidence

High · 8.8/10 · CVSS 3.1. Severity source.

Exploitation not established: Controlled research or code-path evidence; the reviewed sources do not establish malicious exploitation or a confirmed victim.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

An earlier pass marks imports as already reported while formatting them; MLAllowlist then sees those shared deduplication markers and bypasses its checks.

Conditions required

MLAllowlist runs after another pass in the same analysis context on an affected release; dangerous behavior additionally requires an untrusted pickle reaching a callable not caught by other controls.

Potential impact

An inoperative ML import allowlist and unsafe approval of imports outside the permitted ML ecosystem. The published ast.parse proof demonstrates the missed finding, not itself code execution or a victim incident.

Affected versions and configurations

Fickling through 0.1.11.

Fix and mitigation status

0.1.12 fixes the shared-state shadowing and makes MLAllowlist explicitly opt-in; later independent scanner bypasses remain.

Practical next steps

Upgrade and explicitly configure MLAllowlist in the analyzer when required. Test the combined pass order against disallowed imports, and keep model deserialization isolated.

Operating lesson

Composing security checks can disable protection when their deduplication state is shared.

Evidence and limits

Backfill: public PR May 27, merged June 24, advisory/release June 26, CNA July 4. CNA High 8.8 CVSS 3.1 differs from maintainer Moderate. The CNA explicitly links the advisory; fixed 0.1.12 is not a claim that current Fickling has no other weaknesses.

Sources