CVE-2025-67747: 
Python vulnerability analysis and mitigation

CVE-2025-67747 is a security bypass vulnerability in Fickling, a Python pickling decompiler and static analyzer developed by Trail of Bits. The flaw stems from marshal and types being absent from Fickling's block list of unsafe module imports, allowing a crafted malicious pickle file to evade detection. It affects all versions of Fickling prior to 0.1.6 (i.e., <= 0.1.5) and was disclosed on December 15, 2025. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Feedly).

The root cause is an incomplete denylist (CWE-184) in Fickling's unsafe_imports() function within fickling/fickle.py, which failed to include the marshal and types Python standard library modules. An attacker can craft a pickle file that uses marshal.loads() to deserialize compiled Python bytecode and types.FunctionType() to construct a callable from that bytecode — effectively executing arbitrary code while Fickling reports the file as LIKELY_SAFE. The attack requires user interaction: a victim must use Fickling to vet the malicious pickle file and then deserialize it, believing it to be safe (CWE-502). A proof-of-concept disassembly demonstrating the bypass technique was included in the original security advisory (GitHub Advisory, Fix Commit).

Successful exploitation results in arbitrary code execution on the system of any user or automated pipeline that relies on Fickling to validate pickle files for safety. The impact spans high confidentiality, integrity, and availability — an attacker can run arbitrary OS commands (e.g., os.system("id")) under the privileges of the process that deserializes the file. This is particularly dangerous in AI/ML workflows where pickle files (including PyTorch model files) are routinely scanned with Fickling before loading, as a false-safe verdict could lead to silent compromise of model-serving infrastructure or developer workstations (GitHub Advisory).

A proof-of-concept pickle payload demonstrating the bypass was publicly disclosed as part of the security advisory, with the full opcode disassembly included (GitHub Advisory). The CVSS v4.0 exploit maturity is rated PROOF_OF_CONCEPT. The EPSS score is approximately 0.127%, indicating a low but non-negligible probability of exploitation in the wild. No in-the-wild exploitation, threat actor attribution, or CISA KEV catalog listing has been reported at this time (Feedly).

1. Craft malicious bytecode: Compile a malicious Python payload (e.g., import os; os.system("id")) into bytecode using Python's compile() function, then serialize it with marshal.dumps().
2. Build the malicious pickle: Construct a pickle file using opcodes that invoke marshal.loads via STACK_GLOBAL to deserialize the bytecode, then use types.FunctionType to wrap the resulting code object into a callable function.
3. Trigger Fickling analysis: Submit the crafted pickle file to a system or user that uses Fickling (versions <= 0.1.5) to vet it for safety. Fickling will return a LIKELY_SAFE verdict because marshal and types are not in its unsafe module block list.
4. Achieve code execution: The victim, trusting Fickling's false-safe verdict, deserializes the pickle file using Python's pickle.load(). Upon deserialization, the embedded marshal.loads + types.FunctionType chain executes the malicious bytecode, running arbitrary OS commands under the victim's process privileges (GitHub Advisory).

• File System: Pickle files (.pkl, .pt, .pth, or similar) that contain marshal and types module references in their opcode stream; presence of SHORT_BINUNICODE opcodes for strings 'marshal', 'loads', 'types', and 'FunctionType' in sequence.
• Logs: Fickling analysis output returning "severity": "LIKELY_SAFE" for files that subsequently cause unexpected process behavior; absence of detection for marshal or types imports in Fickling's detailed_results.
• Process: Unexpected child processes (e.g., shell commands, network tools) spawned by a Python process immediately after deserializing a pickle file; unusual system calls originating from a Python interpreter loading a model or data file.
• Network: Outbound connections from a Python/ML process to unknown external hosts following pickle deserialization, potentially indicating reverse shell or data exfiltration activity.

Upgrade Fickling to version 0.1.6 or later, which adds marshal and types to the unsafe module block list in fickling/fickle.py (PR #186, commit 4e34561) (v0.1.6 Release). No configuration-based workaround exists for the detection bypass in older versions; the only reliable mitigation is upgrading. As a defense-in-depth measure, avoid deserializing pickle files from untrusted sources regardless of Fickling's verdict, and consider using Fickling's activate_safe_ml_environment() hook in addition to static analysis (Fickling Repo).

The vulnerability was reported by security researchers 0x00nier and ajohnston9, and Trail of Bits responded promptly with a same-day patch on December 15, 2025 (v0.1.6 Release). Red Hat also tracked the issue under their CVE database (Red Hat CVE). No significant broader media coverage or notable community controversy has been identified beyond the standard advisory and vulnerability database entries.