Fickling存在代码注入漏洞，通过pty.spawn()实现

An attacker can exploit this vulnerability by providing a specially crafted pickle file to a system utilizing Fickling. The bypass of the heuristic allows the attacker to execute arbitrary code with the privileges of the running process. This could lead to complete system compromise, data exfiltration, or denial of service. The impact is particularly severe if Fickling is used in a security-sensitive context, such as deserializing data from untrusted sources. The ability to execute arbitrary code opens the door to a wide range of malicious activities, including installing malware, modifying system configurations, and gaining persistent access.

Applications and systems that utilize Fickling to deserialize data from untrusted sources are at risk. This includes systems that process data from external APIs, user uploads, or other potentially malicious sources. Specifically, Python environments where Fickling is a dependency and where pickle deserialization is performed without proper validation are vulnerable.

• python / library:

import pickle
import sys

def check_fickling_version():
    import fickling
    return fickling.__version__

if check_fickling_version() <= '0.1.5':
    print("Vulnerability detected: Fickling version is vulnerable.")
else:
    print("Fickling version is patched.")

1. 2025-12-15Disclosure

   disclosure

1. 已保留2025-12-11
2. 发布日期2025-12-15
3. 修改日期2025-12-20
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2025-67748 is to upgrade Fickling to version 0.1.6 or later, which includes the necessary fix for the unsafe module import restriction. If upgrading is not immediately feasible, consider restricting the sources of pickle files processed by Fickling to only trusted origins. Implement input validation to ensure that pickle files are not accepted from untrusted sources. While not a direct fix, using a sandboxed environment to execute Fickling can limit the potential impact of a successful exploit. After upgrading, verify the fix by attempting to deserialize a known malicious pickle file – it should now be rejected.