CVE-2025-67747

Katalog CVE

CVSS 7.8 · High EPSS 0,28%

Kerentanan Incomplete List of Disallowed Inputs pada trailofbits fickling. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 are missing `marshal` and `types` from the block list of unsafe module imports. Fickling started blocking both modules to address this issue. This allows an attacker to craft a malicious pickle file that can bypass fickling since it misses detections for `types.FunctionType` and `marshal.loads`. A user who deserializes such a file, believing it to be safe, would inadvertently execute arbitrary code on their system. This impacts any user or system that uses Fickling to vet pickle files for security issues. The issue was fixed in version 0.1.6.

Rincian

Terbit di NVD

16 Desember 2025

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-184: Incomplete List of Disallowed Inputs
CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

0,28% peluang dieksploitasi; lebih tinggi dari 18,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/trailofbits/fickling/commit/4e34561301bda1450268d1d7b0b2b151de33b913 patch
• https://github.com/trailofbits/fickling/security/advisories/GHSA-565g-hwwr-4pp3 exploit · advisory pihak ketiga
• https://github.com/trailofbits/fickling/pull/186 issue tracking
• https://github.com/trailofbits/fickling/releases/tag/v0.1.6 release notes