Junglewise Threat Intelligence

CVE-2026-14534: Trail of Bits fickling sandbox bypass via incomplete denylist

CVE-2026-14534 · Severity: high · CVSS 8.8 · Published 2026-07-04

Technologies: fickling (PyPI). Vendors: PyPI.

Executive brief

Fickling is a security tool used to analyze and safely load Python "pickle" files, which are often used in AI and machine learning models. A vulnerability in Fickling's safety scanner allowed malicious files to bypass security checks by using specific Python modules that were missing from its blocklist. If an attacker convinces a user to scan or load a specially crafted malicious file, they could execute arbitrary commands on the user's system, potentially leading to a full system takeover or data theft.

Technical details

A deserialization vulnerability exists in Trail of Bits fickling (versions <= 0.1.10) due to an incomplete denylist in the `UNSAFE_IMPORTS` list within `fickle.py`. The `check_safety()` function fails to identify payloads utilizing `_posixsubprocess.fork_exec`, `site.execsitecustomize`, or `atexit._run_exitfuncs` as dangerous, returning a 'LIKELY_SAFE' verdict. Because `fickling.load()` uses this verdict as a security gate before calling `pickle.loads()`, an attacker can achieve arbitrary code execution via a crafted pickle file. The vulnerability is further exacerbated because the `UnusedVariables` heuristic is bypassed by the `SETITEMS` opcode pattern. This issue was addressed in version 0.1.11 by expanding the blocklist.

Affected products

  • Trail of Bits fickling <= 0.1.10

Timeline

  • 2026-05-06: patched: Fix merged into master and version 0.1.11 released.
  • 2026-07-04: disclosed: CVE-2026-14534 published.

References

Related threats