---
id: "CVE-2026-16760"
kind: "vulnerability"
aliases: ["CVE-2026-16760"]
title: "fickling: pickle safety scanner trusts stdlib callables, letting malicious payloads run code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["fickling", "ml-model-scanning", "package", "pickle-loaders", "python"]
not_affected_if: ["no-untrusted-pickles", "not-using-fickling-gate"]
published_at: "2026-10-30T22:16:54+00:00"
first_seen_at: "2026-10-30T22:25:56+00:00"
updated_at: "2026-10-30T22:27:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16760", "first_seen_at": "2026-10-30T22:25:56+00:00"}]
---

# fickling: pickle safety scanner trusts stdlib callables, letting malicious payloads run code

Trail of Bits fickling is a Python library that scans pickle files for danger before loading them. Through version 0.1.12 its scanner marks any callable from a standard library module as safe, so a crafted pickle that calls functions such as dataclasses._create_fn or mailcap.findmatch passes the check and runs code on the victim's machine when fickling.load() deserializes it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed fickling version with `pip show fickling` or `python -c "import fickling; print(fickling.__version__)"`; versions through `0.1.12` are affected.
- Search your code and CI for calls to `fickling.load(` or `check_safety(` on pickle files that come from outside your system.

## Fix

- fickling: unknown (the sources say the fix is on the vendor master branch in commit d011709, pending release; no released fixed version is stated)

## Timeline

- 2026-10-30T22:25:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-16760

## From the sources

In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the likely_safe_imports set whenever the source module is present in sys.stdlib_module_names and the name is absent from the UNSAFE_IMPORTS denylist, without inspecting what the name resolves to or how it behaves. The OvertlyBadEvals analysis pass in analysis.py then unconditionally skips any call whose function name appears in likely_safe_imports, including calls that would otherwise be flagged as overtly dangerous. As a result, any callable reachable through a non-blocked standard library module inherits module-level trust regardless of its own behavior, and check_safety() returns LIKELY_SAFE with zero findings for pickle payloads that reach code execution or file write through such callables. Demonstrated primitives: dataclasses._create_fn, which passes an attacker-controlled function body to exec() and yields arbitrary code execution on Python 3.7 through 3.12 (the internal _create_fn function was removed in Python 3.13); mailcap.findmatch, which internally calls os.system() on a test command taken from an attacker-controlled caps dictionary, yielding arbitrary code execution on Python versions through 3.12 (the mailcap module was removed in Python 3.13); and readline.add_history() followed by readline.write_history_file(), which writes attacker-controlled content to an arbitrary filesystem path (POSIX platforms, where the readline module is available). fickling.load() chains check_safety() into pickle.loads() as an explicit security gate, so a LIKELY_SAFE verdict causes the payload to be deserialized and executed with the privileges of the victim process. The root cause is the inference of callable safety from module origin; it is independent of, and separately fixable from, the dotted __qualname__ resolution weakness tracked as CVE-2026-118938, which this advisory does not address. As of 2026-10-30 the three demonstrated modules were added to UNSAFE_IMPORTS on the vendor master branch (commit d011709) pending release; released versions through 0.1.12 remain affected, and the module-origin trust root cause persists, as demonstrated by the related CVE-2026-118938 remaining exploitable on that same build.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_