Security Flaw in Fickling Python Decompiler Affects Multiple Users
CVE-2025-67747

7.1HIGH

Key Information:

Vendor

Trailofbits

Status
Fickling
Vendor
CVE Published:
16 December 2025

What is CVE-2025-67747?

The Fickling Python decompiler and static analyzer prior to version 0.1.6 lacks proper restrictions on importing certain modules, specifically 'marshal' and 'types'. This oversight allows attackers to create malicious pickle files that exploit these gaps. Users who deserialize these compromised files, erroneously thinking they are safe, may trigger arbitrary code execution on their systems. The vulnerability was addressed in version 0.1.6, which now includes appropriate checks to enhance security.

Affected Version(s)

fickling < 0.1.6

References

https://github.com/trailofbits/fickling/security/advisori...
x_refsource_CONFIRM
https://github.com/trailofbits/fickling/pull/186
x_refsource_MISC
https://github.com/trailofbits/fickling/commit/4e34561301...
x_refsource_MISC

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.