Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-16760— Fickling check_safety() bypass: likely_safe_imports grants module-origin trust to unvalidated standard library callables

Quick assessment

Affected
trailofbits fickling
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Trail of Bits 开发的 fickling 0.1.12 版本中，fickle.py 文件中的 方法存在安全缺陷：当源模块存在于 （标准库模块列表）中，且被导入的名称未出现在 拒绝列表时，该方法会将该导入名称直接加入 集合，而未检查该名称实际解析为何种对象，也未分析其行为特性。随后，analysis.py 中的 分析步骤会无条件跳过所有函数名称出现在 中的调用，即使这些调用本应被标记为显式危险。 因此，任何可通过未被阻止的标准库模块访问的可调用对象，都会继承该模块级别的信任，而完全忽略其自身行为。这导

CVSS 8.8 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-16760

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Fickling check_safety() bypass: likely_safe_imports grants module-origin trust to unvalidated standard library callables
Source: CVE Program / CVE List V5
Vulnerability Description
In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the likely_safe_imports set whenever the source module is present in sys.stdlib_module_names and the name is absent from the UNSAFE_IMPORTS denylist, without inspecting what the name resolves to or how it behaves. The OvertlyBadEvals analysis pass in analysis.py then unconditionally skips any call whose function name appears in likely_safe_imports, including calls that would otherwise be flagged as overtly dangerous. As a result, any callable reachable through a non-blocked standard library module inherits module-level trust regardless of its own behavior, and check_safety() returns LIKELY_SAFE with zero findings for pickle payloads that reach code execution or file write through such callables. Demonstrated primitives: dataclasses._create_fn, which passes an attacker-controlled function body to exec() and yields arbitrary code execution on Python 3.7 through 3.12 (the internal _create_fn function was removed in Python 3.13); mailcap.findmatch, which internally calls os.system() on a test command taken from an attacker-controlled caps dictionary, yielding arbitrary code execution on Python versions through 3.12 (the mailcap module was removed in Python 3.13); and readline.add_history() followed by readline.write_history_file(), which writes attacker-controlled content to an arbitrary filesystem path (POSIX platforms, where the readline module is available). fickling.load() chains check_safety() into pickle.loads() as an explicit security gate, so a LIKELY_SAFE verdict causes the payload to be deserialized and executed with the privileges of the victim process. The root cause is the inference of callable safety from module origin; it is independent of, and separately fixable from, the dotted __qualname__ resolution weakness tracked as CVE-2026-118938, which this advisory does not address. As of 2026-10-30 the three demonstrated modules were added to UNSAFE_IMPORTS on the vendor master branch (commit d011709) pending release; released versions through 0.1.12 remain affected, and the module-origin trust root cause persists, as demonstrated by the related CVE-2026-118938 remaining exploitable on that same build.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
保护机制失效
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
trailofbits fickling 0 ~ 0.1.12 -

II. Public POCs for CVE-2026-16760

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-16760

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-16760 (1)

Vendor Advisories for CVE-2026-16760 (1)

Proof of Concept for CVE-2026-16760 (1)

Other References for CVE-2026-16760 (1)

IV. Related Vulnerabilities

Same product: fickling
Same vendor: trailofbits
Same weakness: CWE-693