Fickling pickle-safety-gate bypass lets crafted ML model files pass as LIKELY_SAFE and execute code on load (CVE-2026-118938)

In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (e.g. 'Values.read_file') is resolved by pickle's find_class through _getattribute to an arbitrary attribute path rather than a module-level function. Fickling records only the leading component in its import tracking, so the trailing attribute reference is never treated or analyzed as a call; the OvertlyBadEvals analysis pass does not flag it and check_safety() returns LIKELY_SAFE with zero findings. A crafted pickle that reaches optparse.Values.read_file executes exec(open(filename).read(), vars) when the pickle is loaded via fickling.load() — which chains check_safety() into pickle.loads() as an explicit security gate. This is distinct from the module-origin trust weakness CVE-2026-16760 and remains present on the vendor master branch at commit d011709 as of 2026-10-30; no complete fix was verified as of 2026-11-01.

Fickling is a defensive tool used to vet untrusted pickle/model files — precisely the weaponization path for ML supply-chain (malicious .pkl/.pt models, pickle-trained checkpoints). A bypass in its safety gate means a malicious model file can be cleared as 'safe' and then execute arbitrary code when deserialized by an ML pipeline, silently defeating the control that defenders rely on for model-loading isolation. CVSS 8.8, no official patch yet.

An attacker crafts a pickle whose STACK_GLOBAL operand uses a dotted attribute path so that fickling's analysis resolves it to an unrelated module attribute; check_safety() returns LIKELY_SAFE, then the pickle is deserialized and hits a class method (optparse.Values.read_file) that executes the file's contents, achieving arbitrary code execution with the application's privileges.

Trail of Bits fickling <= 0.1.12 (no complete fix verified as of 2026-11-01)

No official patch as of the window; treat fickling results as advisory — avoid deserializing untrusted pickles on the strength of a scanner verdict, use non-executable serialization formats (e.g. safetensors), sandbox/isolate model loading without secrets, and monitor Bombadil Systems / Trail of Bits for a fixed release addressing dotted attribute-path resolution.