CVE-2025-67748

Fickling has Code Injection vulnerability via pty.spawn()

State: Published
Severity: 7.1 High
Published: Dec 16, 2025
Updated: Dec 16, 2025
Reserved: Dec 11, 2025

Description

Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 had a bypass caused by `pty` missing from the block list of unsafe module imports. This led to unsafe pickles based on `pty.spawn()` being incorrectly flagged as `LIKELY_SAFE`, and was fixed in version 0.1.6. This impacted any user or system that used Fickling to vet pickle files for security issues.

Scores

CVSS	Score	Vector	Source
4.0	7.1 High	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P	GitHub_M

Weaknesses

CWE-184 Incomplete List of Disallowed Inputs
CWE-502 Deserialization of Untrusted Data
CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

Product	Versions
ficklingtrailofbits	< 0.1.6Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.