What’s Vulnerable › Vulnerabilities

CVE-2025-67748: Fickling has Code Injection vulnerability via pty.spawn()

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-16 · updated 2026-10-07
• Weakness: CWE-94

Description

Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 had a bypass caused by `pty` missing from the block list of unsafe module imports. This led to unsafe pickles based on `pty.spawn()` being incorrectly flagged as `LIKELY_SAFE`, and was fixed in version 0.1.6. This impacted any user or system that used Fickling to vet pickle files for security issues.

Affected products

• trailofbits fickling: before 0.1.6 — fixed in 0.1.6

How to fix

Upgrade to a fixed version: trailofbits fickling 0.1.6. Check the vendor advisory for mitigations.

References

• https://github.com/trailofbits/fickling/pull/108
• https://github.com/trailofbits/fickling/pull/187
• https://github.com/trailofbits/fickling/security/advisories/GHSA-r7v6-mfhq-g3m2

Get alerted when CVE-2025-67748 or the next vulnerability affects your stack