Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-14535— Fickling MLAllowlist analysis pass rendered inoperative by shared mutable state in AnalysisContext.shorten_code()

Quick assessment

Affected
trailofbits fickling
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Trail of Bits Fickling是美国Trail of Bits公司的一款针对Python序列化漏洞的黑客工具。 Trail of Bits Fickling 0.1.11及之前版本存在处理逻辑错误漏洞，该漏洞源于UnsafeImportsML分析阶段无条件调用AnalysisContext.shorten_code(node)并注册到共享AnalysisContext.reported_shortened_code集合，导致MLAllowlist分析阶段对所有导入节点收到already_re

CVSS 8.8 · High EPSS 0.56% · P45

Possible ATT&CK Techniques 1 AI

T1203 · Exploitation for Client Execution

Affected Version Matrix 2

VendorProduct Version RangeStatus
trailofbits fickling ≤ 0.1.11 affected
0.1.12 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-14535

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Fickling MLAllowlist analysis pass rendered inoperative by shared mutable state in AnalysisContext.shorten_code()
Source: CVE Program / CVE List V5
Vulnerability Description
In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unconditionally calls AnalysisContext.shorten_code(node) on every import node it inspects, regardless of whether the import is flagged as unsafe. This call registers the shortened code representation in the shared AnalysisContext.reported_shortened_code set. When the MLAllowlist analysis pass subsequently runs, it calls the same shorten_code() method, receives already_reported=True for every import, and executes a continue statement that skips its allowlist check entirely. This renders MLAllowlist dead code for all imports — it never evaluates whether an import is in the ML allowlist or not. The MLAllowlist pass was designed to catch imports of modules outside the known-safe ML ecosystem (torch, numpy, transformers, etc.) that slip past the UnsafeImports denylist. With MLAllowlist inoperative, any standard library module not in the UNSAFE_IMPORTS denylist can be invoked via pickle deserialization while fickling's check_safety() returns LIKELY_SAFE. The fickling.load() API chains check_safety() into pickle.loads() as an explicit security gate, meaning a LIKELY_SAFE verdict causes the payload to be deserialized and executed. The root cause is shared mutable state between independently-correct analysis passes — UnsafeImportsML works as designed in isolation, MLAllowlist works as designed in isolation, but the shared reported_shortened_code set causes UnsafeImportsML to poison MLAllowlist's deduplication logic.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
保护机制失效
Source: CVE Program / CVE List V5
Vulnerability Title
Trail of Bits Fickling 处理逻辑错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Trail of Bits Fickling是美国Trail of Bits公司的一款针对Python序列化漏洞的黑客工具。 Trail of Bits Fickling 0.1.11及之前版本存在处理逻辑错误漏洞，该漏洞源于UnsafeImportsML分析阶段无条件调用AnalysisContext.shorten_code(node)并注册到共享AnalysisContext.reported_shortened_code集合，导致MLAllowlist分析阶段对所有导入节点收到already_re
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
trailofbits fickling 0 ~ 0.1.11 -

II. Public POCs for CVE-2026-14535

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
Qwen3.6-35B-A3B · 9282 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-14535

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-14535 (2)

Vendor Advisories for CVE-2026-14535 (1)

Vendor Pages for CVE-2026-14535 (1)

IV. Related Vulnerabilities

Same product: fickling
Same vendor: trailofbits
Same weakness: CWE-693

V. Comments for CVE-2026-14535

No comments yet

Leave a comment