Security advisories

medium2026-03-13

fickling's `platform` module subprocess invocation evades `check_safety()` with `LIKELY_SAFE`

GHSA-5cxw-w2xg-2m8h

medium2026-03-13

fickling modules linecache, difflib and gc are missing from the unsafe modules blocklist

GHSA-r48f-3986-4f9c

high2026-03-04

Fickling missing RCE-capable modules in UNSAFE_IMPORTS

GHSA-5hwf-rc88-82xm

high2026-03-04

Fickling has `always_check_safety()` bypass: pickle.loads and _pickle.loads remain unhooked

GHSA-wccx-j62j-r448

medium2026-02-25

Fickling has safety check bypass via REDUCE+BUILD opcode sequence

GHSA-mhc9-48gj-9gp3

high2026-02-24

Fickling: OBJ opcode call invisibility bypasses all safety checks

GHSA-mxhj-88fx-4pcv

low2026-02-20

Fickling has a detection bypass via stdlib network-protocol constructors

GHSA-83pf-v6qq-pwmr

high2026-01-09

Fickling vulnerable to detection bypass due to "builtins" blindness

GHSA-h4rm-mm56-xf63 · CVE-2026-22612

high2026-01-09

Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist

GHSA-q5qq-mvfm-j35x · CVE-2026-22609

high2026-01-09

Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection

GHSA-5hvc-6wx8-mvv4 · CVE-2026-22608

high2026-01-09

Fickling Blocklist Bypass: cProfile.run()

GHSA-p523-jq9w-64x9 · CVE-2026-22607

high2026-01-09

Fickling has a bypass via runpy.run_path() and runpy.run_module()

GHSA-wfq2-52f7-7qvj · CVE-2026-22606

high2025-12-15

Fickling has Code Injection vulnerability via pty.spawn()

GHSA-r7v6-mfhq-g3m2 · CVE-2025-67748

high2025-12-15

Fickling has missing detection for marshal.loads and types.FunctionType in unsafe modules list

GHSA-565g-hwwr-4pp3 · CVE-2025-67747