Arbitrary Code Execution Vulnerability in Fickling by Trail of Bits
CVE-2026-118938

8.8HIGH

Key Information:

Vendor

Trailofbits

Status
Fickling
Vendor
CVE Published:
30 October 2026

What is CVE-2026-118938?

In Fickling version 0.1.12 by Trail of Bits, an arbitrary code execution vulnerability arises due to improper handling of dotted qualname attributes within the pickle module. Specifically, the resolution of class methods via the _getattribute method allows an attacker to execute arbitrary code when specific crafted pickle files are loaded. The affected method, optparse.Values.read_file, executes a file read operation; thereby, permitting malicious code to run without proper checks. Although mechanisms like check_safety() aim to flag unsafe operations, this particular flaw remains unaddressed in the current vendor master branch. The vulnerability demonstrates a significant oversight in the analysis of dotted attribute-path names, exposing software relying on these imports to sophisticated attacks.

Affected Version(s)

fickling 0 <= 0.1.12

References

https://bombadil.systems/advisories.html
https://pypi.org/project/fickling/0.1.12/
https://github.com/trailofbits/fickling

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Christopher Aziz (Bombadil Systems LLC)
.