Junglewise Threat Intelligence

CVE-2026-14535: Trail of Bits fickling protection bypass in MLAllowlist analysis

CVE-2026-14535 · Severity: high · CVSS 8.8 · Published 2026-07-04

Technologies: fickling (PyPI). Vendors: PyPI.

Executive brief

Trail of Bits fickling, a tool used to analyze and safely load Python pickle files (commonly used in AI/ML models), contains a flaw that bypasses its security checks. A logic error in how the tool tracks reported issues causes it to skip its 'allowlist' check, which is intended to block dangerous code imports. As a result, an attacker could provide a malicious model file that executes arbitrary code on the victim's system, even when fickling's safety features are enabled.

Technical details

A protection mechanism failure exists in fickling versions up to 0.1.11 due to shared mutable state in the AnalysisContext. The UnsafeImportsML analysis pass unconditionally calls AnalysisContext.shorten_code() on all import nodes, which populates the reported_shortened_code set. When the MLAllowlist pass subsequently runs, it sees these imports as already reported and skips its own validation logic. This effectively disables the allowlist check, allowing any standard library module not explicitly in the UNSAFE_IMPORTS denylist to be loaded and executed during pickle deserialization. The vulnerability is triggered when fickling.load() or check_safety() returns a LIKELY_SAFE verdict for a malicious payload. The issue is fixed in version 0.1.12 by decoupling code formatting from reporting state.

Affected products

  • Trail of Bits fickling <= 0.1.11

Timeline

  • 2026-06-25: patched: Fix committed to repository
  • 2026-06-26: advisory: Version 0.1.12 released on PyPI
  • 2026-07-04: disclosed: CVE-2026-14535 published

References

Related threats