N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-wccx-j62j-r448

GHSA-wccx-j62j-r448: Fickling has `always_check_safety()` bypass: pickle.loads and _pickle.loads remain unhooked

Assessment

The missing pickle entrypoints pickle.loads, _pickle.loads, and _pickle.load were added to the hook https://github.com/trailofbits/fickling/commit/8c24c6edabceab156cfd41f4d70b650e1cdad1f7.

Original report

Summary

fickling.always_check_safety() does not hook all pickle entry points. pickle.loads, _pickle.loads, and _pickle.load remain unprotected, enabling malicious payload execution despite global safety mode being enabled.

Affected versions

<= 0.1.8 (verified on current upstream HEAD as of 2026-03-03)

Non-duplication check against published Fickling GHSAs

No published advisory covers hook-coverage bypass in run_hook(). Existing advisories are blocklist/detection bypasses (runpy, pty, cProfile, marshal/types, builtins, network constructors, OBJ visibility, etc.), not runtime hook coverage parity.

Root cause

run_hook() patches only:

pickle.load
pickle.Unpickler
_pickle.Unpickler

It does not patch:

pickle.loads
_pickle.load
_pickle.loads

Reproduction (clean upstream)

import io, pickle, _pickle
from unittest.mock import patch
import fickling
from fickling.exception import UnsafeFileError

class Payload:
    def __reduce__(self):
        import subprocess
        return (subprocess.Popen, (['echo','BYPASS'],))

data = pickle.dumps(Payload())
fickling.always_check_safety()

# Bypass path
with patch('subprocess.Popen') as popen_mock:
    pickle.loads(data)
    print('bypass sink called?', popen_mock.called)  # True

# Control path is blocked
with patch('subprocess.Popen') as popen_mock:
    try:
        pickle.load(io.BytesIO(data))
    except UnsafeFileError:
        pass
    print('blocked sink called?', popen_mock.called)  # False

Observed on vulnerable code:

pickle.loads executes payload
pickle.load is blocked

Minimal patch diff

--- a/fickling/hook.py
+++ b/fickling/hook.py
@@
 def run_hook():
-    pickle.load = loader.load
+    pickle.load = loader.load
+    _pickle.load = loader.load
+    pickle.loads = loader.loads
+    _pickle.loads = loader.loads

Validation after patch

pickle.loads, _pickle.loads, and _pickle.load all raise UnsafeFileError
sink not called in any path

Regression tests added locally:

test_run_hook_blocks_pickle_loads
test_run_hook_blocks__pickle_load_and_loads in test/test_security_regressions_20260303.py

Impact

High-confidence runtime protection bypass for applications that trust always_check_safety() as global guard.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-wccx-j62j-r448

GHSA-wccx-j62j-r448:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
fickling	pip	<= 0.1.8	0.1.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the fickling library's incomplete implementation of its global safety hook mechanism. The function fickling.always_check_safety() is designed to make pickle deserialization safe by patching the standard pickle module's functions. This is done by an internal call to fickling.hook.run_hook().

Analysis of the patch in commit 8c24c6edabceab156cfd41f4d70b650e1cdad1f7 shows that the run_hook function in fickling/hook.py was only patching pickle.load and the Unpickler classes. It neglected to patch other critical deserialization functions: pickle.loads, _pickle.load, and _pickle.loads.

This oversight means that if a developer enables global safety checks with fickling.always_check_safety(), their application is still vulnerable. An attacker can execute arbitrary code by providing a malicious pickle stream that is deserialized using one of the unpatched functions (e.g., pickle.loads). The root cause of the vulnerability is the incomplete patching logic within the fickling.hook.run_hook function, which fails to provide the comprehensive protection it promises.

Vulnerable functions

fickling.hook.run_hook

fickling/hook.py

The `run_hook` function is responsible for monkey-patching the standard `pickle` library to enforce safety checks. The vulnerability is that this function originally failed to patch the `pickle.loads`, `_pickle.load`, and `_pickle.loads` functions. This omission allows an attacker to bypass all of Fickling's security checks by using one of these unpatched functions for deserialization, even if the application has called `fickling.always_check_safety()` to enable global protection.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-wccx-j62j-r448: Fickling has `always_check_safety()` bypass: pickle.loads and _pickle.loads remain unhooked

Assessment

Original report

Summary

Affected versions

Non-duplication check against published Fickling GHSAs

Root cause

Reproduction (clean upstream)

Minimal patch diff

Validation after patch

Impact

GHSA-wccx-j62j-r448:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

N/A

N/A

Technical Details

GHSA-wccx-j62j-r448: Fickling has `always_check_safety()` bypass: pickle.loads and _pickle.loads remain unhooked

Assessment

Original report

Summary

Affected versions

Non-duplication check against published Fickling GHSAs

Root cause

Reproduction (clean upstream)

Minimal patch diff

Validation after patch

Impact

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI