{"answers":{"affected":"2 open source packages ship an affected version, including fickling.","exploited":"There is no known exploitation of GHSA-wccx-j62j-r448 in the wild and no public exploit code.","fix":"Upgrade fickling to 0.1.9 or later.","what":"GHSA-wccx-j62j-r448 is an unsafe deserialization vulnerability in fickling, published on 4 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-wccx-j62j-r448 and fix it if it is affected.\n\nWhat it is: GHSA-wccx-j62j-r448 is an unsafe deserialization vulnerability in fickling, published on 4 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-wccx-j62j-r448 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- fickling (PyPI): affected all versions; fixed in 0.1.9\n- fickling (PyPI): affected all versions; fixed in 0.1.9\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-wccx-j62j-r448/ (Markdown: https://insights.sbomify.com/GHSA-wccx-j62j-r448/index.md)","id":"GHSA-wccx-j62j-r448","markdown":"https://insights.sbomify.com/GHSA-wccx-j62j-r448/index.md","name":"GHSA-wccx-j62j-r448","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"patch","impacts":["code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"Python security library","requires_auth":"none","summary":"Fickling fails to hook all pickle entry points, allowing attackers to execute arbitrary code via deserialization despite safety checks being enabled.","user_interaction":"not_required","vuln_class":"deserialization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"# Assessment\n\nThe missing pickle entrypoints `pickle.loads`, `_pickle.loads`, and `_pickle.load` were added to the hook https://github.com/trailofbits/fickling/commit/8c24c6edabceab156cfd41f4d70b650e1cdad1f7.\n\n# Original report\n\n## Summary\n`fickling.always_check_safety()` does not hook all pickle entry points. `pickle.loads`, `_pickle.loads`, and `_pickle.load` remain unprotected, enabling malicious payload execution despite global safety mode being enabled.\n\n## Affected versions\n`\u003c= 0.1.8` (verified on current upstream HEAD as of 2026-03-03)\n\n## Non-duplication check against published Fickling GHSAs\nNo published advisory covers hook-coverage bypass in `run_hook()`.\nExisting advisories are blocklist/detection bypasses (runpy, pty, cProfile, marshal/types, builtins, network constructors, OBJ visibility, etc.), not runtime hook coverage parity.\n\n## Root cause\n`run_hook()` patches only:\n- `pickle.load`\n- `pickle.Unpickler`\n- `_pickle.Unpickler`\n\nIt does not patch:\n- `pickle.loads`\n- `_pickle.load`\n- `_pickle.loads`\n\n## Reproduction (clean upstream)\n```python\nimport io, pickle, _pickle\nfrom unittest.mock import patch\nimport fickling\nfrom fickling.exception import UnsafeFileError\n\nclass Payload:\n    def __reduce__(self):\n        import subprocess\n        return (subprocess.Popen, (['echo','BYPASS'],))\n\ndata = pickle.dumps(Payload())\nfickling.always_check_safety()\n\n# Bypass path\nwith patch('subprocess.Popen') as popen_mock:\n    pickle.loads(data)\n    print('bypass sink called?', popen_mock.called)  # True\n\n# Control path is blocked\nwith patch('subprocess.Popen') as popen_mock:\n    try:\n        pickle.load(io.BytesIO(data))\n    except UnsafeFileError:\n        pass\n    print('blocked sink called?', popen_mock.called)  # False\n```\n\nObserved on vulnerable code:\n- `pickle.loads` executes payload\n- `pickle.load` is blocked\n\n## Minimal patch diff\n```diff\n--- a/fickling/hook.py\n+++ b/fickling/hook.py\n@@\n def run_hook():\n-    pickle.load = loader.load\n+    pickle.load = loader.load\n+    _pickle.load = loader.load\n+    pickle.loads = loader.loads\n+    _pickle.loads = loader.loads\n```\n\n## Validation after patch\n- `pickle.loads`, `_pickle.loads`, and `_pickle.load` all raise `UnsafeFileError`\n- sink not called in any path\n\nRegression tests added locally:\n- `test_run_hook_blocks_pickle_loads`\n- `test_run_hook_blocks__pickle_load_and_loads`\n  in `test/test_security_regressions_20260303.py`\n\n## Impact\nHigh-confidence runtime protection bypass for applications that trust `always_check_safety()` as global guard.","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Fickling has `always_check_safety()` bypass: pickle.loads and _pickle.loads remain unhooked","id":"GHSA-wccx-j62j-r448","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"deserialization","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":["0.1.9"],"introduced":["0"],"last_affected":[],"package":"fickling","purl":null,"source":"GHSA-wccx-j62j-r448"},{"ecosystem":"PyPI","fixed":["0.1.9"],"introduced":["0"],"last_affected":[],"package":"fickling","purl":"pkg:pypi/fickling","source":"GHSA-wccx-j62j-r448"}],"products":null,"published":"2026-03-04","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Fickling fails to hook all pickle entry points, allowing attackers to execute arbitrary code via deserialization despite safety checks being enabled.","url":"https://insights.sbomify.com/GHSA-wccx-j62j-r448/"}