PT-2025-51355 · Fickling · Fickling

Published 2025-12-15 · Updated 2025-12-21 · CVE-2025-67748

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Fickling versions prior to 0.1.6

Description Fickling, a Python pickling decompiler and static analyzer, contained a bypass related to missing unsafe module imports. Specifically, the pty module was not included in the block list, leading to pickles utilizing pty.spawn() being incorrectly identified as safe. This impacted users and systems relying on Fickling for pickle file security assessments.

Recommendations Update to Fickling version 0.1.6 or later.

Exploit

Fix

Incomplete List of Disallowed Inputs

Code Injection

Deserialization of Untrusted Data

Weakness Enumeration

CWE-184

CWE-94

CWE-502

Related Identifiers

CVE-2025-67748

GHSA-R7V6-MFHQ-G3M2

PYSEC-2025-113

Affected Products

Fickling

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67748.json · Exploit
• https://github.com/trailofbits/fickling/pull/108 · Patch
• https://github.com/trailofbits/fickling/pull/187 · Patch
• https://github.com/trailofbits/fickling/security/advisories/GHSA-r7v6-mfhq-g3m2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-67748 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67748 · Security Note
• https://osv.dev/vulnerability/PYSEC-2025-113 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r7v6-mfhq-g3m2 · Vendor Advisory
• https://github.com/trailofbits/fickling · Note
• https://twitter.com/CVEnew/status/2002836003401126166 · Twitter Post
• https://t.me/CVEtracker/39904 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2000835377158828479 · Twitter Post