Is CVE-2026-14535 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14535 being exploited in the wild.

How severe is CVE-2026-14535?

High severity, with a CVSS score of 8.8, published 4 July 2026.

Which products and versions are affected?

fickling (PyPI) ECOSYSTEM:introduced=0,fixed=0.1.12.

Is there a fix for CVE-2026-14535?

Yes. fickling (PyPI): upgrade to 0.1.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-14535 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-14535?

Check whether you run fickling (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14535: Trail of Bits fickling protection bypass in MLAllowlist analysis

CVE-2026-14535 · Severity: high · CVSS 8.8 · Published 2026-07-04

Trail of Bits fickling, a tool used to analyze and safely load Python pickle files (commonly used in AI/ML models), contains a flaw that bypasses its security checks. A logic error in how the tool tracks reported issues causes it to skip its 'allowlist' check, which is intended to block dangerous code imports. As a result, an attacker could provide a malicious model file that executes arbitrary code on the victim's system, even when fickling's safety features are enabled.

Technologies: fickling (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-14535 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14535 being exploited in the wild.
How severe is CVE-2026-14535?: High severity, with a CVSS score of 8.8, published 4 July 2026.
Which products and versions are affected?: fickling (PyPI) ECOSYSTEM:introduced=0,fixed=0.1.12.
Is there a fix for CVE-2026-14535?: Yes. fickling (PyPI): upgrade to 0.1.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-14535 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-14535?: Check whether you run fickling (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

fickling (PyPI): upgrade to 0.1.12 or later
```
pip install "fickling>=0.1.12"
```

Technical details

A protection mechanism failure exists in fickling versions up to 0.1.11 due to shared mutable state in the AnalysisContext. The UnsafeImportsML analysis pass unconditionally calls AnalysisContext.shorten_code() on all import nodes, which populates the reported_shortened_code set. When the MLAllowlist pass subsequently runs, it sees these imports as already reported and skips its own validation logic. This effectively disables the allowlist check, allowing any standard library module not explicitly in the UNSAFE_IMPORTS denylist to be loaded and executed during pickle deserialization. The vulnerability is triggered when fickling.load() or check_safety() returns a LIKELY_SAFE verdict for a malicious payload. The issue is fixed in version 0.1.12 by decoupling code formatting from reporting state.

Affected products

Trail of Bits fickling <= 0.1.11

Identifiers

CVE-2026-14535
PYSEC-2026-2150

Timeline

2026-06-25: patched: Fix committed to repository
2026-06-26: advisory: Version 0.1.12 released on PyPI
2026-07-04: disclosed: CVE-2026-14535 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.