Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
NVD Vulnerability Details :
CVE-2025-67747
Analyzed
More InfoOfficial Page
Source-security-advisories@github.com
View Known Exploited Vulnerability (KEV) details
Published At-16 Dec, 2025 | 01:15
Updated At-02 Jan, 2026 | 15:59

Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 are missing `marshal` and `types` from the block list of unsafe module imports. Fickling started blocking both modules to address this issue. This allows an attacker to craft a malicious pickle file that can bypass fickling since it misses detections for `types.FunctionType` and `marshal.loads`. A user who deserializes such a file, believing it to be safe, would inadvertently execute arbitrary code on their system. This impacts any user or system that uses Fickling to vet pickle files for security issues. The issue was fixed in version 0.1.6.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary4.07.1HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary3.17.8HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Type: Secondary
Version: 4.0
Base score: 7.1
Base severity: HIGH
Vector:
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Type: Primary
Version: 3.1
Base score: 7.8
Base severity: HIGH
Vector:
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CPE Matches

trailofbits
trailofbits
>>fickling>>Versions before 0.1.6(exclusive)
cpe:2.3:a:trailofbits:fickling:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-184Primarysecurity-advisories@github.com
CWE-502Primarysecurity-advisories@github.com
CWE ID: CWE-184
Type: Primary
Source: security-advisories@github.com
CWE ID: CWE-502
Type: Primary
Source: security-advisories@github.com
Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References
HyperlinkSourceResource
https://github.com/trailofbits/fickling/commit/4e34561301bda1450268d1d7b0b2b151de33b913security-advisories@github.com
Patch
https://github.com/trailofbits/fickling/pull/186security-advisories@github.com
Issue Tracking
https://github.com/trailofbits/fickling/releases/tag/v0.1.6security-advisories@github.com
Release Notes
https://github.com/trailofbits/fickling/security/advisories/GHSA-565g-hwwr-4pp3security-advisories@github.com
Exploit
Third Party Advisory
Hyperlink: https://github.com/trailofbits/fickling/commit/4e34561301bda1450268d1d7b0b2b151de33b913
Source: security-advisories@github.com
Resource:
Patch
Hyperlink: https://github.com/trailofbits/fickling/pull/186
Source: security-advisories@github.com
Resource:
Issue Tracking
Hyperlink: https://github.com/trailofbits/fickling/releases/tag/v0.1.6
Source: security-advisories@github.com
Resource:
Release Notes
Hyperlink: https://github.com/trailofbits/fickling/security/advisories/GHSA-565g-hwwr-4pp3
Source: security-advisories@github.com
Resource:
Exploit
Third Party Advisory
Change History
0Changes found

Details not found