# CVE-2026-14534: Trail of Bits fickling sandbox bypass via incomplete denylist

Source: https://junglewise.ai/threats/cve-2026-14534-trail-of-bits-fickling-sandbox-bypass-via-incomplete-denylist  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-04. Updated: 2026-07-04  
License: CC BY 4.0 with a link back

CVE-2026-14534 · Severity: high · CVSS 8.8 · Published 2026-07-04

Fickling is a security tool used to analyze and safely load Python "pickle" files, which are often used in AI and machine learning models. A vulnerability in Fickling's safety scanner allowed malicious files to bypass security checks by using specific Python modules that were missing from its blocklist. If an attacker convinces a user to scan or load a specially crafted malicious file, they could execute arbitrary commands on the user's system, potentially leading to a full system takeover or data theft.

Technologies: [fickling (PyPI)](https://junglewise.ai/threats/technologies/fickling). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-14534 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14534 being exploited in the wild.

**How severe is CVE-2026-14534?** High severity, with a CVSS score of 8.8, published 4 July 2026.

**Which products and versions are affected?** fickling (PyPI) ECOSYSTEM:introduced=0,fixed=0.1.11.

**Is there a fix for CVE-2026-14534?** Yes. fickling (PyPI): upgrade to 0.1.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14534 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-14534?** Check whether you run fickling (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- fickling (PyPI): upgrade to 0.1.11 or later

  ```sh
  pip install "fickling>=0.1.11"
  ```


## Technical details

A deserialization vulnerability exists in Trail of Bits fickling (versions <= 0.1.10) due to an incomplete denylist in the `UNSAFE_IMPORTS` list within `fickle.py`. The `check_safety()` function fails to identify payloads utilizing `_posixsubprocess.fork_exec`, `site.execsitecustomize`, or `atexit._run_exitfuncs` as dangerous, returning a 'LIKELY_SAFE' verdict. Because `fickling.load()` uses this verdict as a security gate before calling `pickle.loads()`, an attacker can achieve arbitrary code execution via a crafted pickle file. The vulnerability is further exacerbated because the `UnusedVariables` heuristic is bypassed by the `SETITEMS` opcode pattern. This issue was addressed in version 0.1.11 by expanding the blocklist.

## Affected products

- Trail of Bits fickling <= 0.1.10

## Identifiers

- CVE-2026-14534
- PYSEC-2026-2149

## Timeline

- 2026-05-06: patched: Fix merged into master and version 0.1.11 released.
- 2026-07-04: disclosed: CVE-2026-14534 published.

## References

- [https://pypi.org/project/fickling/](https://pypi.org/project/fickling/)
- [https://github.com/trailofbits/fickling/commit/e8408615b63adf034f891f653692ab9b51f0f5af](https://github.com/trailofbits/fickling/commit/e8408615b63adf034f891f653692ab9b51f0f5af)
- [https://github.com/trailofbits/fickling/pull/272](https://github.com/trailofbits/fickling/pull/272)
- [https://github.com/trailofbits/fickling/releases/tag/v0.1.11](https://github.com/trailofbits/fickling/releases/tag/v0.1.11)
- [https://github.com/trailofbits/fickling/security/advisories/GHSA-m6fh-58r7-x697](https://github.com/trailofbits/fickling/security/advisories/GHSA-m6fh-58r7-x697)

## Related threats

- [PYSEC-2026-1370 - Fickling vulnerable to detection bypass due to "builtins" blindness](https://junglewise.ai/threats/cve-2026-22612-fickling-vulnerable-to-detection-bypass-due-to-builtins-blindness)
- [PYSEC-2026-1372 - Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist](https://junglewise.ai/threats/cve-2026-22609-fickling-has-static-analysis-bypass-via-incomplete-dangerous)
- [PYSEC-2026-1369 - Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection](https://junglewise.ai/threats/cve-2026-22608-fickling-vulnerable-to-use-of-ctypes-and-pydoc-gadget-chain-to)
- [PYSEC-2026-1371 - Fickling Blocklist Bypass: cProfile.run()](https://junglewise.ai/threats/cve-2026-22607-fickling-blocklist-bypass-cprofile-run)
- [PYSEC-2026-1373 - Fickling has a bypass via runpy.run_path() and runpy.run_module()](https://junglewise.ai/threats/cve-2026-22606-fickling-has-a-bypass-via-runpy-run-path-and-runpy-run-module)