GitHub Security Advisory: GHSA-wfq2-52f7-7qvj
Package: fickling (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-184: Incomplete List of Disallowed Inputs, CWE-502: Deserialization of Untrusted Data
Vulnerable versions: <= 0.1.6
Patched in: 0.1.7

Summary: Fickling has a bypass via runpy.run_path() and runpy.run_module()

Details:
# Fickling's assessment

`runpy`  was added to the list of unsafe imports (https://github.com/trailofbits/fickling/commit/9a2b3f89bd0598b528d62c10a64c1986fcb09f66).

# Original report

### Summary
Fickling versions up to and including 0.1.6 do not treat Python’s runpy module as unsafe. Because of this, a malicious pickle that uses runpy.run_path() or runpy.run_module() is classified as SUSPICIOUS instead of OVERTLY_MALICIOUS.

If a user relies on Fickling’s output to decide whether a pickle is safe to deserialize, this misclassification can lead them to execute attacker-controlled code on their system.

This affects any workflow or product that uses Fickling as a security gate for pickle deserialization.

### Details
The `runpy` module is missing from fickling's block list of unsafe module imports in `fickling/analysis.py`. This is the same root cause as CVE-2025-67748 (pty) and CVE-2025-67747 (marshal/types).

Incriminated source code:
- File: `fickling/analysis.py`
- Class: `UnsafeImports`
- Issue: The blocklist does not include `runpy`, `runpy.run_path`, `runpy.run_module`, or `runpy._run_code`

Reference to similar fix:
- PR #187 added `pty` to the blocklist to fix CVE-2025-67748
- PR #108 documented the blocklist approach
- The same fix pattern should be applied for `runpy`

How the bypass works:
1. Attacker creates a pickle using `runpy.run_path()` in `__reduce__`
2. Fickling's `UnsafeImports` analysis does not flag `runpy` as dangerous
3. Only the `UnusedVariables` heuristic triggers, resulting in `SUSPICIOUS` severity
4. The pickle should be rated `OVERTLY_MALICIOUS` like `os.system`, `eval`, and `exec`

Tested behavior (fickling 0.1.6):

| Function          | Fickling Severity          | RCE Capable |
|-------------------|----------------------------|-------------|
| os.system         | LIKELY_OVERTLY_MALICIOUS   | Yes         |
| eval              | OVERTLY_MALICIOUS          | Yes         |
| exec              | OVERTLY_MALICIOUS          | Yes         |
| runpy.run_path    | SUSPICIOUS                 | Yes ← BYPASS |
| runpy.run_module  | SUSPICIOUS                 | Yes ← BYPASS |

Suggested fix:
Add to the unsafe imports blocklist in `fickling/analysis.py`:
- runpy
- runpy.run_path
- runpy.run_module
- runpy._run_code
- runpy._run_module_code

### PoC
_Complete instructions, including specific configuration details, to reproduce the vulnerability._**Environment:**
- Python 3.13.2
- fickling 0.1.6 (latest version, installed via pip)

Step 1: Create malicious pickle

import pickle
import runpy

class MaliciousPayload:
    def __reduce__(self):
        return (runpy.run_path, ("/tmp/malicious_script.py",))

with open("malicious.pkl", "wb") as f:
    pickle.dump(MaliciousPayload(), f)

Step 2: Create the malicious script that will be executed

echo 'print("RCE ACHIEVED"); open("/tmp/pwned","w").write("compromised")' > /tmp/malicious_script.py

Step 3: Analyze with fickling

fickling --check-safety malicious.pkl

Expected output (if pro