CVE-2025-67747

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-67747
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-67747.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-67747
Aliases
Published
2025-12-16T00:32:52.714Z
Modified
2026-01-29T02:50:53.481072Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
Fickling has missing detection for marshal.loads and types.FunctionType in unsafe modules list
Details

Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 are missing marshal and types from the block list of unsafe module imports. Fickling started blocking both modules to address this issue. This allows an attacker to craft a malicious pickle file that can bypass fickling since it misses detections for types.FunctionType and marshal.loads. A user who deserializes such a file, believing it to be safe, would inadvertently execute arbitrary code on their system. This impacts any user or system that uses Fickling to vet pickle files for security issues. The issue was fixed in version 0.1.6.

Database specific 
{
    "cwe_ids": [
        "CWE-184",
        "CWE-502"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67747.json"
}
References

Affected packages

Git / github.com/trailofbits/fickling

Affected ranges

Type
GIT
Repo
https://github.com/trailofbits/fickling
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8249522c7180c69436516ff81bff394f62298c0c

Affected versions

Other
master
v0.*
v0.0.1
v0.0.2
v0.0.3
v0.0.4
v0.0.5
v0.0.6
v0.0.7
v0.0.8
v0.1.0
v0.1.1
v0.1.2
v0.1.3
v0.1.4
v0.1.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-67747.json"