{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.1.8"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "fickling"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-693"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-04T21:30:16Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "# Assessment\n\nThe missing pickle entrypoints `pickle.loads`, `_pickle.loads`, and `_pickle.load` were added to the hook https://github.com/trailofbits/fickling/commit/8c24c6edabceab156cfd41f4d70b650e1cdad1f7.\n\n# Original report\n\n## Summary\n`fickling.always_check_safety()` does not hook all pickle entry points. `pickle.loads`, `_pickle.loads`, and `_pickle.load` remain unprotected, enabling malicious payload execution despite global safety mode being enabled.\n\n## Affected versions\n`\u003c= 0.1.8` (verified on current upstream HEAD as of 2026-03-03)\n\n## Non-duplication check against published Fickling GHSAs\nNo published advisory covers hook-coverage bypass in `run_hook()`.\nExisting advisories are blocklist/detection bypasses (runpy, pty, cProfile, marshal/types, builtins, network constructors, OBJ visibility, etc.), not runtime hook coverage parity.\n\n## Root cause\n`run_hook()` patches only:\n- `pickle.load`\n- `pickle.Unpickler`\n- `_pickle.Unpickler`\n\nIt does not patch:\n- `pickle.loads`\n- `_pickle.load`\n- `_pickle.loads`\n\n## Reproduction (clean upstream)\n```python\nimport io, pickle, _pickle\nfrom unittest.mock import patch\nimport fickling\nfrom fickling.exception import UnsafeFileError\n\nclass Payload:\n    def __reduce__(self):\n        import subprocess\n        return (subprocess.Popen, ([\u0027echo\u0027,\u0027BYPASS\u0027],))\n\ndata = pickle.dumps(Payload())\nfickling.always_check_safety()\n\n# Bypass path\nwith patch(\u0027subprocess.Popen\u0027) as popen_mock:\n    pickle.loads(data)\n    print(\u0027bypass sink called?\u0027, popen_mock.called)  # True\n\n# Control path is blocked\nwith patch(\u0027subprocess.Popen\u0027) as popen_mock:\n    try:\n        pickle.load(io.BytesIO(data))\n    except UnsafeFileError:\n        pass\n    print(\u0027blocked sink called?\u0027, popen_mock.called)  # False\n```\n\nObserved on vulnerable code:\n- `pickle.loads` executes payload\n- `pickle.load` is blocked\n\n## Minimal patch diff\n```diff\n--- a/fickling/hook.py\n+++ b/fickling/hook.py\n@@\n def run_hook():\n-    pickle.load = loader.load\n+    pickle.load = loader.load\n+    _pickle.load = loader.load\n+    pickle.loads = loader.loads\n+    _pickle.loads = loader.loads\n```\n\n## Validation after patch\n- `pickle.loads`, `_pickle.loads`, and `_pickle.load` all raise `UnsafeFileError`\n- sink not called in any path\n\nRegression tests added locally:\n- `test_run_hook_blocks_pickle_loads`\n- `test_run_hook_blocks__pickle_load_and_loads`\n  in `test/test_security_regressions_20260303.py`\n\n## Impact\nHigh-confidence runtime protection bypass for applications that trust `always_check_safety()` as global guard.",
  "id": "GHSA-wccx-j62j-r448",
  "modified": "2026-03-04T21:30:16Z",
  "published": "2026-03-04T21:30:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/trailofbits/fickling/security/advisories/GHSA-wccx-j62j-r448"
    },
    {
      "type": "WEB",
      "url": "https://github.com/trailofbits/fickling/commit/8c24c6edabceab156cfd41f4d70b650e1cdad1f7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/trailofbits/fickling"
    },
    {
      "type": "WEB",
      "url": "https://github.com/trailofbits/fickling/releases/tag/v0.1.9"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Fickling has `always_check_safety()` bypass: pickle.loads and _pickle.loads remain unhooked"
}