Arbitrary Code Execution in Fickling

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: BombadilSystems

Description

In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example "Values.read_file") is resolved by pickle's find_class through _getattribute to an arbitrary attribute path rather than to a module-level function. Fickling records only the leading component of the name in its import tracking and renders the operation as a plain import (for instance, 'python -m fickling' displays it as 'from optparse import Values.read_file'), so the trailing attribute reference is never analyzed as a call. The OvertlyBadEvals analysis pass does not flag it, and check_safety() returns LIKELY_SAFE with zero findings. This allows an attacker to reach a class method that performs code execution: optparse.Values.read_file executes exec(open(filename).read(), vars), achieving arbitrary code execution when the crafted pickle is loaded through fickling.load(), which chains check_safety() into pickle.loads() as an explicit security gate. optparse is present in all current CPython 3.x releases (deprecated as of Python 3.13, not removed). This weakness is in the resolution and analysis of dotted attribute-path names, and is distinct from and independently fixable from the module-origin trust weakness tracked as CVE-2026-16760: resolving or flagging dotted attribute-path imports closes this vector while leaving the module-level trust behavior unchanged. This bypass was verified to remain present on the vendor master branch at commit d011709 as of 2026-10-30, after the vendor's October blocklist additions and a new heuristic that flags private stdlib attributes; because the public class method Values.read_file is neither blocklisted nor flagged as a private attribute, it is not addressed by those remediations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-30

Last Modified

2026-10-30

Generated

2026-10-31

AI Q&A

2026-10-31

EPSS Evaluated

N/A

NVD

CVE-2026-118938

Affected Vendors & Products

Vendor	Product	Version / Range
trailofbits	fickling	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-706	The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This vulnerability in Trail of Bits fickling through 0.1.12 allows an attacker to bypass security checks by using a crafted pickle file. The issue occurs when a pickle STACK_GLOBAL operand contains a dotted __qualname__ like 'Values.read_file'. Fickling only records the leading component (e.g., 'optparse') and treats it as a safe import, ignoring the trailing attribute. This lets the attacker execute a class method that performs code execution, such as optparse.Values.read_file, which runs arbitrary code via exec(open(filename).read(), vars).

Impact Analysis

If you use fickling to handle pickle files, an attacker could craft a malicious pickle file that executes arbitrary code on your system when loaded. This could lead to data breaches, system compromise, or unauthorized access. The vulnerability affects all current CPython 3.x releases since optparse is always present.

Mitigation Strategies

Update fickling to a version beyond 0.1.12 where this issue is resolved. Avoid loading untrusted pickle files and implement strict input validation for any pickle data processed by your system.

Hi! I’m here to help you understand CVE-2026-118938. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70