Description
Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, both ctypes and pydoc modules aren't explicitly blocked. Even other existing pickle scanning tools (like picklescan) do not block pydoc.locate. Chaining these two together can achieve RCE while the scanner still reports the file as LIKELY_SAFE. This issue has been patched in version 0.1.7.
References (3)
Scores
CVSS v3
7.8
EPSS
0.0004
EPSS Percentile
12.8%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
total
Details
CWE
CWE-184
CWE-502
Status
published
Products (2)
pypi/fickling
0 - 0.1.7PyPI
trailofbits/fickling
< 0.1.7
Published
Jan 10, 2026
Tracked Since
Feb 18, 2026