Vulnerability Description
Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 had a bypass caused by `pty` missing from the block list of unsafe module imports. This led to unsafe pickles based on `pty.spawn()` being incorrectly flagged as `LIKELY_SAFE`, and was fixed in version 0.1.6. This impacted any user or system that used Fickling to vet pickle files for security issues.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Trailofbits | Fickling | < 0.1.6 |
Related Weaknesses (CWE)
References
- https://github.com/trailofbits/fickling/pull/108Issue TrackingPatch
- https://github.com/trailofbits/fickling/pull/187Issue TrackingPatch
- https://github.com/trailofbits/fickling/security/advisories/GHSA-r7v6-mfhq-g3m2ExploitVendor Advisory
FAQ
What is CVE-2025-67748?
CVE-2025-67748 is a vulnerability with a CVSS score of 7.8 (HIGH). Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 had a bypass caused by `pty` missing from the block list of unsafe module imports. This led to unsafe pickles base...
How severe is CVE-2025-67748?
CVE-2025-67748 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-67748?
Check the references section above for vendor advisories and patch information. Affected products include: Trailofbits Fickling.