{"answers":{"affected":"2 open source packages ship an affected version, including fickling.","exploited":"There is no known exploitation of GHSA-5cxw-w2xg-2m8h in the wild and no public exploit code.","fix":"Upgrade fickling to 0.1.10 or later.","what":"GHSA-5cxw-w2xg-2m8h is a vulnerability in fickling, published on 13 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for GHSA-5cxw-w2xg-2m8h and fix it if it is affected.\n\nWhat it is: GHSA-5cxw-w2xg-2m8h is a vulnerability in fickling, published on 13 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of GHSA-5cxw-w2xg-2m8h in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- fickling (PyPI): affected all versions; fixed in 0.1.10\n- fickling (PyPI): affected all versions; fixed in 0.1.10\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-5cxw-w2xg-2m8h/ (Markdown: https://insights.sbomify.com/GHSA-5cxw-w2xg-2m8h/index.md)","id":"GHSA-5cxw-w2xg-2m8h","markdown":"https://insights.sbomify.com/GHSA-5cxw-w2xg-2m8h/index.md","name":"GHSA-5cxw-w2xg-2m8h","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"patch","impacts":["security_bypass","data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Python pickle safety library","requires_auth":"none","summary":"Crafted pickles bypass fickling's safety checks via platform module, allowing subprocess invocation and file probing during deserialization.","user_interaction":"required","vuln_class":"security_feature_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"# Our assessment\n\nWe added `platform` to the blocklist of unsafe modules (https://github.com/trailofbits/fickling/commit/351ed4d4242b447c0ffd550bb66b40695f3f9975). \n\nIt was not possible to inject extra arguments to `file` without first monkey-patching `platform._follow_symlinks` with the pickle, as it always returns an absolute path. We independently hardened it with https://github.com/trailofbits/fickling/commit/b9e690c5a57ee9cd341de947fc6151959f4ae359 to reduce the risk of obtaining direct module references while evading detection.\n\nhttps://github.com/python/cpython/blob/6d1e9ceed3e70ebc39953f5ad4f20702ffa32119/Lib/platform.py#L687-L695\n```python\ntarget = _follow_symlinks(target)\n# \"file\" output is locale dependent: force the usage of the C locale\n# to get deterministic behavior.\nenv = dict(os.environ, LC_ALL='C')\ntry:\n    # -b: do not prepend filenames to output lines (brief mode)\n    output = subprocess.check_output(['file', '-b', target],\n                                     stderr=subprocess.DEVNULL,\n                                     env=env)\n```\n\n# Original report\n\n## Summary\nA crafted pickle invoking `platform._syscmd_file`, `platform.architecture`, or `platform.libc_ver` passes `check_safety()` with `Severity.LIKELY_SAFE` and zero findings. During `fickling.loads()`, these functions invoke `subprocess.check_output` with attacker-controlled arguments or read arbitrary files from disk.\n\n**Clarification:** The subprocess call uses a list argument (`['file', '-b', target]`), not `shell=True`, so the attacker controls the file path argument to the `file` command, not the command itself. The impact is subprocess invocation with attacker-controlled arguments and information disclosure (file type probing), not arbitrary command injection.\n\n## Affected versions\n`\u003c= 0.1.9` (verified on upstream HEAD as of 2026-03-04)\n\n## Non-duplication check against published Fickling GHSAs\nNo published advisory covers `platform` module false-negative bypass. This follows the same structural pattern as GHSA-5hwf-rc88-82xm (missing modules in `UNSAFE_IMPORTS`) but covers a distinct set of functions.\n\n## Root cause\n1. `platform` not in `UNSAFE_IMPORTS` denylist.\n2. `OvertlyBadEvals` skips calls imported from stdlib modules.\n3. `UnusedVariables` heuristic neutralized by making call result appear used (`SETITEMS` path).\n\n## Reproduction (clean upstream)\n```python\nfrom unittest.mock import patch\nimport fickling\nimport fickling.fickle as op\nfrom fickling.fickle import Pickled\nfrom fickling.analysis import check_safety\n\npickled = Pickled([\n    op.Proto.create(4),\n    op.ShortBinUnicode('platform'),\n    op.ShortBinUnicode('_syscmd_file'),\n    op.StackGlobal(),\n    op.ShortBinUnicode('/etc/passwd'),\n    op.TupleOne(),\n    op.Reduce(),\n    op.Memoize(),\n    op.EmptyDict(),\n    op.ShortBinUnicode('init'),\n    op.ShortBinUnicode('x'),\n    op.SetItem(),\n    op.Mark(),\n    op.ShortBinUnicode('trace'),\n    op.BinGet(0),\n    op.SetItems(),\n    op.Stop(),\n])\n\nresults = check_safety(pickled)\nprint(results.severity.name, len(results.results))  # LIKELY_SAFE 0\n\nwith patch('subprocess.check_output', return_value=b'ASCII text') as mock_sub:\n    fickling.loads(pickled.dumps())\n    print('subprocess called?', mock_sub.called)       # True\n    print('args:', mock_sub.call_args[0])               # (['file', '-b', '/etc/passwd'],)\n```\n\nAdditional affected functions (same pattern):\n- `platform.architecture('/etc/passwd')` — calls `_syscmd_file` internally\n- `platform.libc_ver('/etc/passwd')` — opens and reads arbitrary file contents\n\n## Minimal patch diff\n```diff\n--- a/fickling/fickle.py\n+++ b/fickling/fickle.py\n@@\n+        \"platform\",\n```\n\n## Validation after patch\n- Same PoC flips to `LIKELY_OVERTLY_MALICIOUS`\n- `fickling.loads` raises `UnsafeFileError`\n- `subprocess.check_output` is not called\n\n## Impact\n- **False-negative verdict:** `check_safety()` returns `LIKELY_SAFE` with zero findings for a pickle that invokes a subprocess with attacker-controlled arguments.\n- **Subprocess invocation:** `platform._syscmd_file` calls `subprocess.check_output(['file', '-b', target])` where `target` is attacker-controlled. The `file` command reads file headers and returns type information, enabling file existence and type probing.\n- **File read:** `platform.libc_ver` opens and reads chunks of an attacker-specified file path.","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"fickling's `platform` module subprocess invocation evades `check_safety()` with `LIKELY_SAFE`","id":"GHSA-5cxw-w2xg-2m8h","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"security_feature_bypass","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":["0.1.10"],"introduced":["0"],"last_affected":[],"package":"fickling","purl":null,"source":"GHSA-5cxw-w2xg-2m8h"},{"ecosystem":"PyPI","fixed":["0.1.10"],"introduced":["0"],"last_affected":[],"package":"fickling","purl":"pkg:pypi/fickling","source":"GHSA-5cxw-w2xg-2m8h"}],"products":null,"published":"2026-03-13","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Crafted pickles bypass fickling's safety checks via platform module, allowing subprocess invocation and file probing during deserialization.","url":"https://insights.sbomify.com/GHSA-5cxw-w2xg-2m8h/"}