PT-2025-51355 · Fickling · Fickling

CVE-2025-67748 · Published 2025-12-15 · Updated 2026-07-10

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Fickling versions prior to 0.1.6

Description Fickling, a Python pickling decompiler and static analyzer, contained a bypass related to missing unsafe module imports. Specifically, the pty module was not included in the block list, leading to pickles utilizing pty.spawn() being incorrectly identified as safe. This impacted users and systems relying on Fickling for pickle file security assessments.

Recommendations Update to Fickling version 0.1.6 or later.

Exploit

Fix

Code Injection

Incomplete List of Disallowed Inputs

Deserialization of Untrusted Data

Weakness Enumeration

CWE-94

CWE-184

CWE-502

Related Identifiers

CVE-2025-67748

GHSA-R7V6-MFHQ-G3M2

PYSEC-2025-113

Affected Products

Fickling

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67748.json · Exploit
• https://github.com/trailofbits/fickling/pull/187 · Patch
• https://github.com/trailofbits/fickling/pull/108 · Patch
• https://github.com/trailofbits/fickling/security/advisories/GHSA-r7v6-mfhq-g3m2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-67748 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2025-113 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67748 · Security Note
• https://osv.dev/vulnerability/GHSA-r7v6-mfhq-g3m2 · Vendor Advisory
• https://github.com/trailofbits/fickling · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/fickling/PYSEC-2025-113.yaml · Note
• https://t.me/cveNotify/194874 · Telegram Post
• https://t.me/CVEtracker/39904 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2000835377158828479 · Twitter Post
• https://t.me/CVEtracker/58927 · Telegram Post
• https://t.me/cveNotify/188869 · Telegram Post