{"cve":"CVE-2025-67747","nvd":{"published":"2025-12-16T01:15:52.803","modified":"2026-10-07T19:10:00.160","status":"Analyzed","description":"Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 are missing `marshal` and `types` from the block list of unsafe module imports. Fickling started blocking both modules to address this issue. This allows an attacker to craft a malicious pickle file that can bypass fickling since it misses detections for `types.FunctionType` and `marshal.loads`. A user who deserializes such a file, believing it to be safe, would inadvertently execute arbitrary code on their system. This impacts any user or system that uses Fickling to vet pickle files for security issues. The issue was fixed in version 0.1.6.","cvss_v4":{"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","score":7.1},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-184","CWE-502"],"references":["https://github.com/trailofbits/fickling/commit/4e34561301bda1450268d1d7b0b2b151de33b913","https://github.com/trailofbits/fickling/pull/186","https://github.com/trailofbits/fickling/releases/tag/v0.1.6","https://github.com/trailofbits/fickling/security/advisories/GHSA-565g-hwwr-4pp3"],"products":["trailofbits:fickling"],"source":"nvd","synced_at":"2026-10-19T22:17:07.138532058+00:00"},"epss":{"cve":"CVE-2025-67747","score":0.00278,"percentile":0.20069,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-565g-hwwr-4pp3","url":"https://osv.dev/vulnerability/GHSA-565g-hwwr-4pp3","summary":"Fickling has missing detection for marshal.loads and types.FunctionType in unsafe modules list","modified":"2026-07-07T17:56:35.964643039Z","packages":[{"ecosystem":"PyPI","name":"fickling","purl":"pkg:pypi/fickling","ranges":["<0.1.6"],"fixed":["0.1.6"]}]},{"id":"PYSEC-2026-1368","url":"https://osv.dev/vulnerability/PYSEC-2026-1368","summary":"Fickling has missing detection for marshal.loads and types.FunctionType in unsafe modules list","modified":"2026-07-07T17:47:13.895266893Z","packages":[{"ecosystem":"PyPI","name":"fickling","purl":"pkg:pypi/fickling","ranges":["<0.1.6"],"fixed":["0.1.6"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}