{"id":"CVE-2025-67748","published":"2025-12-16T00:39:13Z","modified":"2025-12-16T21:12:34Z","title":"Fickling has Code Injection vulnerability via pty.spawn()","vendor":"trailofbits","product":"fickling","tier":"tail","description":{"text":"Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 had a bypass caused by `pty` missing from the block list of unsafe module imports. This led to unsafe pickles based on `pty.spawn()` being incorrectly flagged as `LIKELY_SAFE`, and was fixed in version 0.1.6. This impacted any user or system that used Fickling to vet pickle files for security issues.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.1,"severity":"HIGH","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.0027,"percentile":0.19132,"provenance":"source"},"cwes":[{"id":"CWE-184","name":"Incomplete List of Disallowed Inputs"},{"id":"CWE-502","name":"Deserialization of Untrusted Data"},{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://github.com/trailofbits/fickling/security/advisories/GHSA-r7v6-mfhq-g3m2","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/trailofbits/fickling/pull/108","tags":["x_refsource_MISC"]},{"url":"https://github.com/trailofbits/fickling/pull/187","tags":["x_refsource_MISC"]}],"priority":{"score":8.8,"factors":[{"name":"EPSS percentile","points":3.83},{"name":"CVSS severity","points":4.97}]},"vendorSlug":"trailofbits","affectedVersions":[{"vendor":"trailofbits","product":"fickling","versions":["< 0.1.6"]}],"affected":[{"ecosystem":"PyPI","package":"fickling","vulnerableRanges":["<0.1.6"],"patched":["0.1.6"],"from":["GHSA-r7v6-mfhq-g3m2","PYSEC-2025-113"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-203478","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-trailofbits-fickling-cve-2025-67747","children":[{"from":"CVE-2025-67748","to":"CVE-2026-14534","relation":"variant","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"variant","quote":"This shares the same root cause as CVE-2026-22607 (cProfile), CVE-2025-67748 (pty), and CVE-2025-67747 (marshal/types).","from":"CVE.org","in":"CVE-2026-14534"}]},{"from":"CVE-2025-67748","to":"CVE-2026-22606","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-wfq2-52f7-7qvj","via":"reference","url":"https://github.com/trailofbits/fickling/security/advisories/GHSA-r7v6-mfhq-g3m2"},{"kind":"osv-related","provenance":"source","id":"PYSEC-2026-1373","via":"reference","url":"https://github.com/trailofbits/fickling/security/advisories/GHSA-r7v6-mfhq-g3m2"}]},{"from":"CVE-2025-67748","to":"CVE-2026-22607","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-p523-jq9w-64x9","via":"reference","url":"https://github.com/trailofbits/fickling/security/advisories/GHSA-r7v6-mfhq-g3m2"},{"kind":"osv-related","provenance":"source","id":"PYSEC-2026-1371","via":"reference","url":"https://github.com/trailofbits/fickling/security/advisories/GHSA-r7v6-mfhq-g3m2"}]}]}}