CVE-2026-16760

Fickling module-origin trust bypasses pickle safety checks

Trail of Bits · Fickling pickle and ML model security tooling

First documented disclosure · Review checkpoint

Summary

Callable behavior can escape analysis when a standard-library module is treated as safe.

Severity and exploitation evidence

High · 8.8/10 · CVSS 3.1. Severity source.

Exploitation not established: Controlled research or code-path evidence; the reviewed sources do not establish malicious exploitation or a confirmed victim.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Imported names from non-blocklisted standard-library modules enter likely_safe_imports, and the dangerous-call analysis skips them. A safe verdict can then authorize pickle deserialization.

Conditions required

A user or service loads an attacker-supplied pickle through the affected security gate. Demonstrated dataclasses and mailcap primitives require Python versions through 3.12; readline file-writing requires the POSIX module.

Potential impact

Code execution or arbitrary file writes with the loading process privileges, depending on the available callable and platform.

Affected versions and configurations

Fickling through 0.1.12 per the researcher CNA; PyPI still lists 0.1.12 as latest on November 1.

Fix and mitigation status

No fixed release verified. The October 30 master snapshot includes blocklist additions for the demonstrated modules, but the researcher reports the module-trust root cause persists.

Practical next steps

Do not use a LIKELY_SAFE verdict as permission to deserialize untrusted models. Prefer non-executable model formats and isolated loading without secrets; monitor a supported release addressing the root cause.

Operating lesson

A safety scanner must analyze callable behavior rather than equate standard-library origin with trust.

Evidence and limits

October 30 is the dated public CNA disclosure; the researcher index gives only October. Raw source at d011709 confirms the three blocklist entries, but that commit itself changes PyTorch ZIP reading and is a snapshot, not proof of a complete fix. Distinct from CVE-2026-118938; no malicious exploitation is established.

Sources