Arbitrary Code Execution Vulnerability in Fickling by Trail of Bits

CVE-2026-16760

What is CVE-2026-16760?

Fickling versions prior to the latest commit contain a vulnerability that enables arbitrary code execution via the _process_import() method in fickle.py. This flaw arises from the method's ability to add imported names to the likely_safe_imports set without verifying their behavior. Consequently, calls to potentially dangerous functions are skipped during security analysis, allowing attackers to manipulate callable functions and exploit the underlying system. This manifests in several exploits, including passing unsafe function bodies and executing commands through controlled module attributes, ultimately compromising the integrity of the victim’s process. While recent commits have attempted to mitigate this by adding safety checks for certain modules, the root vulnerability tied to module-origin trust remains unresolved.

References