Vulnerability-Lookup

CVE-2026-14534 (GCVE-0-2026-14534)

Vulnerability from cvelistv5 – Published: 2026-07-04 13:25 – Updated: 2026-07-06 14:59

Title

Fickling check_safety() bypass via unlisted standard library modules (_posixsubprocess, site, atexit)

Summary

Trail of Bits fickling versions up to and including 0.1.10 do not include the Python standard library modules _posixsubprocess, site, and atexit in the UNSAFE_IMPORTS denylist (fickle.py). Because these modules are absent from the denylist, fickling's check_safety() function returns LIKELY_SAFE with zero findings for pickle payloads that invoke dangerous functions including _posixsubprocess.fork_exec (C-level process spawner capable of executing arbitrary binaries), site.execsitecustomize (executes arbitrary site customization code), and atexit._run_exitfuncs (triggers all registered exit handler callbacks). The fickling.load() API chains check_safety() into pickle.loads() as an explicit security gate; a LIKELY_SAFE verdict causes the payload to be deserialized and executed. This shares the same root cause as CVE-2026-22607 (cProfile), CVE-2025-67748 (pty), and CVE-2025-67747 (marshal/types). OvertlyBadEvals does not flag these modules because they are standard library imports. UnsafeImports does not flag them because they are not in the denylist. The UnusedVariables heuristic is defeated by the SETITEMS opcode pattern.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-06 14:59 UTC

CWE

CWE-184 - Incomplete List of Disallowed Inputs
CWE-502 - Deserialization of Untrusted Data

Assigner

BombadilSystems CNA under the mitre root

CNA scorecard – unranked: 4 records in the last 180 days, 10 needed details

References

4 references

URL	Tags
https://github.com/trailofbits/fickling/security/…
https://github.com/trailofbits/fickling/pull/272
https://github.com/trailofbits/fickling/commit/e8…
https://github.com/trailofbits/fickling/releases/…

Impacted products

1 product

Vendor	Product	Version	CPE status
trailofbits	fickling	Affected: 0 , ≤ 0.1.10 (custom) Unaffected: 0.1.11 (custom)	guessed

Date Public

2026-06-28 00:08

Credits

Christopher Aziz (Bombadil Systems LLC)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-14534",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-06T14:59:25.631510Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-06T14:59:37.264Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/trailofbits/fickling/security/advisories/GHSA-m6fh-58r7-x697"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pypi.org/project/fickling/",
          "defaultStatus": "unaffected",
          "packageName": "fickling",
          "product": "fickling",
          "vendor": "trailofbits",
          "versions": [
            {
              "lessThanOrEqual": "0.1.10",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "0.1.11",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Christopher Aziz (Bombadil Systems LLC)"
        }
      ],
      "datePublic": "2026-06-28T00:08:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eTrail of Bits fickling versions up to and including 0.1.10 do not include the Python standard library modules _posixsubprocess, site, and atexit in the UNSAFE_IMPORTS denylist (fickle.py). Because these modules are absent from the denylist, fickling\u0027s check_safety() function returns LIKELY_SAFE with zero findings for pickle payloads that invoke dangerous functions including _posixsubprocess.fork_exec (C-level process spawner capable of executing arbitrary binaries), site.execsitecustomize (executes arbitrary site customization code), and atexit._run_exitfuncs (triggers all registered exit handler callbacks). The fickling.load() API chains check_safety() into pickle.loads() as an explicit security gate; a LIKELY_SAFE verdict causes the payload to be deserialized and executed. This shares the same root cause as CVE-2026-22607 (cProfile), CVE-2025-67748 (pty), and CVE-2025-67747 (marshal/types). OvertlyBadEvals does not flag these modules because they are standard library imports. UnsafeImports does not flag them because they are not in the denylist. The UnusedVariables heuristic is defeated by the SETITEMS opcode pattern.\u003c/p\u003e"
            }
          ],
          "value": "Trail of Bits fickling versions up to and including 0.1.10 do not include the Python standard library modules _posixsubprocess, site, and atexit in the UNSAFE_IMPORTS denylist (fickle.py). Because these modules are absent from the denylist, fickling\u0027s check_safety() function returns LIKELY_SAFE with zero findings for pickle payloads that invoke dangerous functions including _posixsubprocess.fork_exec (C-level process spawner capable of executing arbitrary binaries), site.execsitecustomize (executes arbitrary site customization code), and atexit._run_exitfuncs (triggers all registered exit handler callbacks). The fickling.load() API chains check_safety() into pickle.loads() as an explicit security gate; a LIKELY_SAFE verdict causes the payload to be deserialized and executed. This shares the same root cause as CVE-2026-22607 (cProfile), CVE-2025-67748 (pty), and CVE-2025-67747 (marshal/types). OvertlyBadEvals does not flag these modules because they are standard library imports. UnsafeImports does not flag them because they are not in the denylist. The UnusedVariables heuristic is defeated by the SETITEMS opcode pattern."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An attacker can craft a malicious pickle file that invokes _posixsubprocess.fork_exec to spawn arbitrary processes. When a victim\u0027s ML pipeline passes this file through fickling.load(), fickling classifies it as LIKELY_SAFE and deserializes it, executing attacker-controlled code with the privileges of the victim process."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-184",
              "description": "CWE-184 Incomplete List of Disallowed Inputs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-04T13:25:55.283Z",
        "orgId": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082",
        "shortName": "BombadilSystems"
      },
      "references": [
        {
          "name": "GitHub Security Advisory GHSA-m6fh-58r7-x697",
          "url": "https://github.com/trailofbits/fickling/security/advisories/GHSA-m6fh-58r7-x697"
        },
        {
          "name": "Fix PR #272",
          "url": "https://github.com/trailofbits/fickling/pull/272"
        },
        {
          "name": "Fix commit e840861",
          "url": "https://github.com/trailofbits/fickling/commit/e8408615b63adf034f891f653692ab9b51f0f5af"
        },
        {
          "name": "Fickling v0.1.11 release",
          "url": "https://github.com/trailofbits/fickling/releases/tag/v0.1.11"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Fickling check_safety() bypass via unlisted standard library modules (_posixsubprocess, site, atexit)",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082",
    "assignerShortName": "BombadilSystems",
    "cveId": "CVE-2026-14534",
    "datePublished": "2026-07-04T13:25:55.283Z",
    "dateReserved": "2026-07-03T00:02:49.289Z",
    "dateUpdated": "2026-07-06T14:59:37.264Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-14534",
      "date": "2026-11-04",
      "epss": "0.00594",
      "percentile": "0.48531"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://pypi.org/project/fickling/",
                "defaultStatus": "unaffected",
                "packageName": "fickling",
                "product": "fickling",
                "vendor": "trailofbits",
                "versions": [
                  {
                    "lessThanOrEqual": "0.1.10",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  },
                  {
                    "status": "unaffected",
                    "version": "0.1.11",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:trailofbits:fickling:*:*:*:*:*:python:*:*",
                    "matchCriteriaId": "7D2B4444-58DC-4227-BBD7-D68FB61FA761",
                    "versionEndIncluding": "0.1.10",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Trail of Bits fickling versions up to and including 0.1.10 do not include the Python standard library modules _posixsubprocess, site, and atexit in the UNSAFE_IMPORTS denylist (fickle.py). Because these modules are absent from the denylist, fickling\u0027s check_safety() function returns LIKELY_SAFE with zero findings for pickle payloads that invoke dangerous functions including _posixsubprocess.fork_exec (C-level process spawner capable of executing arbitrary binaries), site.execsitecustomize (executes arbitrary site customization code), and atexit._run_exitfuncs (triggers all registered exit handler callbacks). The fickling.load() API chains check_safety() into pickle.loads() as an explicit security gate; a LIKELY_SAFE verdict causes the payload to be deserialized and executed. This shares the same root cause as CVE-2026-22607 (cProfile), CVE-2025-67748 (pty), and CVE-2025-67747 (marshal/types). OvertlyBadEvals does not flag these modules because they are standard library imports. UnsafeImports does not flag them because they are not in the denylist. The UnusedVariables heuristic is defeated by the SETITEMS opcode pattern."
          },
          {
            "lang": "es",
            "value": "Las versiones de fickling de Trail of Bits hasta la 0.1.10 inclusive no incluyen los m\u00f3dulos de la biblioteca est\u00e1ndar de Python _posixsubprocess, site y atexit en la lista de denegaci\u00f3n UNSAFE_IMPORTS (fickle.py). Debido a que estos m\u00f3dulos est\u00e1n ausentes de la lista de denegaci\u00f3n, la funci\u00f3n check_safety() de fickling devuelve LIKELY_SAFE con cero hallazgos para cargas \u00fatiles de pickle que invocan funciones peligrosas, incluyendo _posixsubprocess.fork_exec (generador de procesos a nivel de C capaz de ejecutar binarios arbitrarios), site.execsitecustomize (ejecuta c\u00f3digo de personalizaci\u00f3n de sitio arbitrario) y atexit._run_exitfuncs (activa todas las devoluciones de llamada de los gestores de salida registrados). La API fickling.load() encadena check_safety() en pickle.loads() como una puerta de seguridad expl\u00edcita; un veredicto LIKELY_SAFE hace que la carga \u00fatil sea deserializada y ejecutada. Esto comparte la misma causa ra\u00edz que CVE-2026-22607 (cProfile), CVE-2025-67748 (pty) y CVE-2025-67747 (marshal/types). OvertlyBadEvals no marca estos m\u00f3dulos porque son importaciones de la biblioteca est\u00e1ndar. UnsafeImports no los marca porque no est\u00e1n en la lista de denegaci\u00f3n. La heur\u00edstica UnusedVariables es eludida por el patr\u00f3n de c\u00f3digo de operaci\u00f3n SETITEMS."
          }
        ],
        "id": "CVE-2026-14534",
        "lastModified": "2026-10-25T15:10:00.147",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-14534",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-06T14:59:25.631510Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-04T14:16:28.400",
        "references": [
          {
            "source": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/trailofbits/fickling/commit/e8408615b63adf034f891f653692ab9b51f0f5af"
          },
          {
            "source": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082",
            "tags": [
              "Issue Tracking",
              "Patch"
            ],
            "url": "https://github.com/trailofbits/fickling/pull/272"
          },
          {
            "source": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082",
            "tags": [
              "Release Notes"
            ],
            "url": "https://github.com/trailofbits/fickling/releases/tag/v0.1.11"
          },
          {
            "source": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/trailofbits/fickling/security/advisories/GHSA-m6fh-58r7-x697"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/trailofbits/fickling/security/advisories/GHSA-m6fh-58r7-x697"
          }
        ],
        "sourceIdentifier": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-184"
              },
              {
                "lang": "en",
                "value": "CWE-502"
              }
            ],
            "source": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-06T22:00:57+00:00",
      "cve": "CVE-2026-14534",
      "id": "CVE-2026-14534",
      "initial_release_date": "2026-07-04T13:25:55.283000+00:00",
      "product_status:known_affected": "2",
      "product_status:known_not_affected": "3",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "fickling: python: fickling: Arbitrary code execution due to incomplete denylist in deserialization",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-14534.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-14534",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-06T14:59:25.631510Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-06T14:59:19.393Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/trailofbits/fickling/security/advisories/GHSA-m6fh-58r7-x697"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://pypi.org/project/fickling/",
              "defaultStatus": "unaffected",
              "packageName": "fickling",
              "product": "fickling",
              "vendor": "trailofbits",
              "versions": [
                {
                  "lessThanOrEqual": "0.1.10",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                },
                {
                  "status": "unaffected",
                  "version": "0.1.11",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Christopher Aziz (Bombadil Systems LLC)"
            }
          ],
          "datePublic": "2026-06-28T00:08:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eTrail of Bits fickling versions up to and including 0.1.10 do not include the Python standard library modules _posixsubprocess, site, and atexit in the UNSAFE_IMPORTS denylist (fickle.py). Because these modules are absent from the denylist, fickling\u0027s check_safety() function returns LIKELY_SAFE with zero findings for pickle payloads that invoke dangerous functions including _posixsubprocess.fork_exec (C-level process spawner capable of executing arbitrary binaries), site.execsitecustomize (executes arbitrary site customization code), and atexit._run_exitfuncs (triggers all registered exit handler callbacks). The fickling.load() API chains check_safety() into pickle.loads() as an explicit security gate; a LIKELY_SAFE verdict causes the payload to be deserialized and executed. This shares the same root cause as CVE-2026-22607 (cProfile), CVE-2025-67748 (pty), and CVE-2025-67747 (marshal/types). OvertlyBadEvals does not flag these modules because they are standard library imports. UnsafeImports does not flag them because they are not in the denylist. The UnusedVariables heuristic is defeated by the SETITEMS opcode pattern.\u003c/p\u003e"
                }
              ],
              "value": "Trail of Bits fickling versions up to and including 0.1.10 do not include the Python standard library modules _posixsubprocess, site, and atexit in the UNSAFE_IMPORTS denylist (fickle.py). Because these modules are absent from the denylist, fickling\u0027s check_safety() function returns LIKELY_SAFE with zero findings for pickle payloads that invoke dangerous functions including _posixsubprocess.fork_exec (C-level process spawner capable of executing arbitrary binaries), site.execsitecustomize (executes arbitrary site customization code), and atexit._run_exitfuncs (triggers all registered exit handler callbacks). The fickling.load() API chains check_safety() into pickle.loads() as an explicit security gate; a LIKELY_SAFE verdict causes the payload to be deserialized and executed. This shares the same root cause as CVE-2026-22607 (cProfile), CVE-2025-67748 (pty), and CVE-2025-67747 (marshal/types). OvertlyBadEvals does not flag these modules because they are standard library imports. UnsafeImports does not flag them because they are not in the denylist. The UnusedVariables heuristic is defeated by the SETITEMS opcode pattern."
            }
          ],
          "impacts": [
            {
              "descriptions": [
                {
                  "lang": "en",
                  "value": "An attacker can craft a malicious pickle file that invokes _posixsubprocess.fork_exec to spawn arbitrary processes. When a victim\u0027s ML pipeline passes this file through fickling.load(), fickling classifies it as LIKELY_SAFE and deserializes it, executing attacker-controlled code with the privileges of the victim process."
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-184",
                  "description": "CWE-184 Incomplete List of Disallowed Inputs",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-502",
                  "description": "CWE-502 Deserialization of Untrusted Data",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-04T13:25:55.283Z",
            "orgId": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082",
            "shortName": "BombadilSystems"
          },
          "references": [
            {
              "name": "GitHub Security Advisory GHSA-m6fh-58r7-x697",
              "url": "https://github.com/trailofbits/fickling/security/advisories/GHSA-m6fh-58r7-x697"
            },
            {
              "name": "Fix PR #272",
              "url": "https://github.com/trailofbits/fickling/pull/272"
            },
            {
              "name": "Fix commit e840861",
              "url": "https://github.com/trailofbits/fickling/commit/e8408615b63adf034f891f653692ab9b51f0f5af"
            },
            {
              "name": "Fickling v0.1.11 release",
              "url": "https://github.com/trailofbits/fickling/releases/tag/v0.1.11"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Fickling check_safety() bypass via unlisted standard library modules (_posixsubprocess, site, atexit)",
          "x_generator": {
            "engine": "Vulnogram 1.0.2"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082",
        "assignerShortName": "BombadilSystems",
        "cveId": "CVE-2026-14534",
        "datePublished": "2026-07-04T13:25:55.283Z",
        "dateReserved": "2026-07-03T00:02:49.289Z",
        "dateUpdated": "2026-07-06T14:59:37.264Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-14534

Vulnerability from fkie_nvd - Published: 2026-07-04 14:16 - Updated: 2026-10-25 15:10

Severity

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
aa17e1a1-c329-4d6e-a1ed-8d0188aea082	https://github.com/trailofbits/fickling/commit/e8408615b63adf034f891f653692ab9b51f0f5af	Patch
aa17e1a1-c329-4d6e-a1ed-8d0188aea082	https://github.com/trailofbits/fickling/pull/272	Issue Tracking, Patch
aa17e1a1-c329-4d6e-a1ed-8d0188aea082	https://github.com/trailofbits/fickling/releases/tag/v0.1.11	Release Notes
aa17e1a1-c329-4d6e-a1ed-8d0188aea082	https://github.com/trailofbits/fickling/security/advisories/GHSA-m6fh-58r7-x697	Exploit, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/trailofbits/fickling/security/advisories/GHSA-m6fh-58r7-x697	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	trailofbits	fickling	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://pypi.org/project/fickling/",
          "defaultStatus": "unaffected",
          "packageName": "fickling",
          "product": "fickling",
          "vendor": "trailofbits",
          "versions": [
            {
              "lessThanOrEqual": "0.1.10",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "0.1.11",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:trailofbits:fickling:*:*:*:*:*:python:*:*",
              "matchCriteriaId": "7D2B4444-58DC-4227-BBD7-D68FB61FA761",
              "versionEndIncluding": "0.1.10",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Trail of Bits fickling versions up to and including 0.1.10 do not include the Python standard library modules _posixsubprocess, site, and atexit in the UNSAFE_IMPORTS denylist (fickle.py). Because these modules are absent from the denylist, fickling\u0027s check_safety() function returns LIKELY_SAFE with zero findings for pickle payloads that invoke dangerous functions including _posixsubprocess.fork_exec (C-level process spawner capable of executing arbitrary binaries), site.execsitecustomize (executes arbitrary site customization code), and atexit._run_exitfuncs (triggers all registered exit handler callbacks). The fickling.load() API chains check_safety() into pickle.loads() as an explicit security gate; a LIKELY_SAFE verdict causes the payload to be deserialized and executed. This shares the same root cause as CVE-2026-22607 (cProfile), CVE-2025-67748 (pty), and CVE-2025-67747 (marshal/types). OvertlyBadEvals does not flag these modules because they are standard library imports. UnsafeImports does not flag them because they are not in the denylist. The UnusedVariables heuristic is defeated by the SETITEMS opcode pattern."
    },
    {
      "lang": "es",
      "value": "Las versiones de fickling de Trail of Bits hasta la 0.1.10 inclusive no incluyen los m\u00f3dulos de la biblioteca est\u00e1ndar de Python _posixsubprocess, site y atexit en la lista de denegaci\u00f3n UNSAFE_IMPORTS (fickle.py). Debido a que estos m\u00f3dulos est\u00e1n ausentes de la lista de denegaci\u00f3n, la funci\u00f3n check_safety() de fickling devuelve LIKELY_SAFE con cero hallazgos para cargas \u00fatiles de pickle que invocan funciones peligrosas, incluyendo _posixsubprocess.fork_exec (generador de procesos a nivel de C capaz de ejecutar binarios arbitrarios), site.execsitecustomize (ejecuta c\u00f3digo de personalizaci\u00f3n de sitio arbitrario) y atexit._run_exitfuncs (activa todas las devoluciones de llamada de los gestores de salida registrados). La API fickling.load() encadena check_safety() en pickle.loads() como una puerta de seguridad expl\u00edcita; un veredicto LIKELY_SAFE hace que la carga \u00fatil sea deserializada y ejecutada. Esto comparte la misma causa ra\u00edz que CVE-2026-22607 (cProfile), CVE-2025-67748 (pty) y CVE-2025-67747 (marshal/types). OvertlyBadEvals no marca estos m\u00f3dulos porque son importaciones de la biblioteca est\u00e1ndar. UnsafeImports no los marca porque no est\u00e1n en la lista de denegaci\u00f3n. La heur\u00edstica UnusedVariables es eludida por el patr\u00f3n de c\u00f3digo de operaci\u00f3n SETITEMS."
    }
  ],
  "id": "CVE-2026-14534",
  "lastModified": "2026-10-25T15:10:00.147",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-14534",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-06T14:59:25.631510Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-04T14:16:28.400",
  "references": [
    {
      "source": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/trailofbits/fickling/commit/e8408615b63adf034f891f653692ab9b51f0f5af"
    },
    {
      "source": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "url": "https://github.com/trailofbits/fickling/pull/272"
    },
    {
      "source": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/trailofbits/fickling/releases/tag/v0.1.11"
    },
    {
      "source": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/trailofbits/fickling/security/advisories/GHSA-m6fh-58r7-x697"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/trailofbits/fickling/security/advisories/GHSA-m6fh-58r7-x697"
    }
  ],
  "sourceIdentifier": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-184"
        },
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ],
      "source": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082",
      "type": "Secondary"
    }
  ]
}

GHSA-V8CR-9JRC-FWF9

Vulnerability from github – Published: 2026-07-04 15:30 – Updated: 2026-07-04 15:30

Details

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-14534"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-184"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-04T14:16:28Z",
    "severity": "HIGH"
  },
  "details": "Trail of Bits fickling versions up to and including 0.1.10 do not include the Python standard library modules _posixsubprocess, site, and atexit in the UNSAFE_IMPORTS denylist (fickle.py). Because these modules are absent from the denylist, fickling\u0027s check_safety() function returns LIKELY_SAFE with zero findings for pickle payloads that invoke dangerous functions including _posixsubprocess.fork_exec (C-level process spawner capable of executing arbitrary binaries), site.execsitecustomize (executes arbitrary site customization code), and atexit._run_exitfuncs (triggers all registered exit handler callbacks). The fickling.load() API chains check_safety() into pickle.loads() as an explicit security gate; a LIKELY_SAFE verdict causes the payload to be deserialized and executed. This shares the same root cause as CVE-2026-22607 (cProfile), CVE-2025-67748 (pty), and CVE-2025-67747 (marshal/types). OvertlyBadEvals does not flag these modules because they are standard library imports. UnsafeImports does not flag them because they are not in the denylist. The UnusedVariables heuristic is defeated by the SETITEMS opcode pattern.",
  "id": "GHSA-v8cr-9jrc-fwf9",
  "modified": "2026-07-04T15:30:23Z",
  "published": "2026-07-04T15:30:23Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/trailofbits/fickling/security/advisories/GHSA-m6fh-58r7-x697"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14534"
    },
    {
      "type": "WEB",
      "url": "https://github.com/trailofbits/fickling/pull/272"
    },
    {
      "type": "WEB",
      "url": "https://github.com/trailofbits/fickling/commit/e8408615b63adf034f891f653692ab9b51f0f5af"
    },
    {
      "type": "WEB",
      "url": "https://github.com/trailofbits/fickling/releases/tag/v0.1.11"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

PYSEC-2026-2149

Vulnerability from pysec - Published: 2026-07-04 14:16 - Updated: 2026-07-13 05:48

Details

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Impacted products

Name	purl
fickling	pkg:pypi/fickling

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "PyPI",
        "name": "fickling",
        "purl": "pkg:pypi/fickling"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.0.1",
        "0.0.2",
        "0.0.3",
        "0.0.4",
        "0.0.5",
        "0.0.6",
        "0.0.7",
        "0.0.8",
        "0.1.10",
        "0.1.2",
        "0.1.3",
        "0.1.4",
        "0.1.5",
        "0.1.6",
        "0.1.7",
        "0.1.8",
        "0.1.9"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-14534",
    "GHSA-m6fh-58r7-x697"
  ],
  "details": "Trail of Bits fickling versions up to and including 0.1.10 do not include the Python standard library modules _posixsubprocess, site, and atexit in the UNSAFE_IMPORTS denylist (fickle.py). Because these modules are absent from the denylist, fickling\u0027s check_safety() function returns LIKELY_SAFE with zero findings for pickle payloads that invoke dangerous functions including _posixsubprocess.fork_exec (C-level process spawner capable of executing arbitrary binaries), site.execsitecustomize (executes arbitrary site customization code), and atexit._run_exitfuncs (triggers all registered exit handler callbacks). The fickling.load() API chains check_safety() into pickle.loads() as an explicit security gate; a LIKELY_SAFE verdict causes the payload to be deserialized and executed. This shares the same root cause as CVE-2026-22607 (cProfile), CVE-2025-67748 (pty), and CVE-2025-67747 (marshal/types). OvertlyBadEvals does not flag these modules because they are standard library imports. UnsafeImports does not flag them because they are not in the denylist. The UnusedVariables heuristic is defeated by the SETITEMS opcode pattern.",
  "id": "PYSEC-2026-2149",
  "modified": "2026-07-13T05:48:44.859047Z",
  "published": "2026-07-04T14:16:28.400Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/trailofbits/fickling/releases/tag/v0.1.11"
    },
    {
      "type": "FIX",
      "url": "https://github.com/trailofbits/fickling/commit/e8408615b63adf034f891f653692ab9b51f0f5af"
    },
    {
      "type": "FIX",
      "url": "https://github.com/trailofbits/fickling/pull/272"
    },
    {
      "type": "EVIDENCE",
      "url": "https://github.com/trailofbits/fickling/security/advisories/GHSA-m6fh-58r7-x697"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-14534 (GCVE-0-2026-14534)

FKIE_CVE-2026-14534

GHSA-V8CR-9JRC-FWF9

PYSEC-2026-2149

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour