AI Threat AlertCVE-2026-118938: fickling: dotted-name bypass lets malicious pickle pass scan
HIGHTrail of Bits fickling, a tool used to vet pickle files before loading, can be fooled into rating a malicious pickle as LIKELY_SAFE. A dotted attribute path such as optparse.Values.read_file is recorded as a plain import, so fickling.load() runs attacker-controlled code even though the safety check reported zero findings. This matters for AI teams because they rely on fickling as a security gate for untrusted model artifacts, and the gate fails silently. The CVSS is 8.8 (network, low complexity, no privileges, user interaction required). There is no KEV listing, no public exploit, no Nuclei template and no EPSS data yet, so exploitation is not yet observed, but the technique is simple and is described in the public advisory. The bypass was confirmed still present on the vendor master branch (commit d011709) as of 2026-10-30, so there is no reliable fixed version. Stop treating fickling's LIKELY_SAFE verdict as sufficient for untrusted pickles: load only trusted artifacts, prefer safetensors or other non-executable formats, and run any unavoidable pickle loading in an isolated sandbox.
What is the risk?
High. The CVSS is 8.8 and the flaw defeats a control that exists only to stop malicious deserialization. Exploitation needs a victim to load a crafted pickle, which is a common workflow for downloaded models and datasets. The attacker needs no privileges and the pickle is very small. No EPSS score, KEV listing, public exploit or scanner template exists as of publication, so likelihood is uncertain rather than low. The false sense of safety is the main risk: teams that adopted fickling as a gate may load untrusted artifacts on that basis. The target module (optparse) ships with every CPython 3.x release, so no unusual dependency is needed. The vendor's October blocklist and private-attribute heuristics do not cover this vector.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Fickling | pip | — | No patch |
Do you use Fickling? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Check the fickling project and the PyPI page for a fixed release beyond 0.1.12 and upgrade once one ships; the bypass remained unpatched on master as of 2026-10-30. 2) Do not treat check_safety() output or LIKELY_SAFE as a sufficient gate for untrusted pickles. 3) Prefer non-executable formats (safetensors, ONNX, GGUF) and reject pickle-based artifacts from untrusted sources. 4) If you must load pickles, do it in a sandbox (container or VM with no network, no credentials, read-only filesystem, low privileges) and layer a second scanner such as picklescan. 5) Add allowlist-based unpickling that blocks dotted STACK_GLOBAL names and access to optparse.Values. 6) Detection: search pickle opcodes for STACK_GLOBAL operands that contain dots, alert on optparse references in model files, and monitor ML workers for unexpected exec() or child-process spawning and for outbound connections after model load. 7) Inventory every pipeline that calls fickling.load() or relies on fickling verdicts.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-118938?
Trail of Bits fickling, a tool used to vet pickle files before loading, can be fooled into rating a malicious pickle as LIKELY_SAFE. A dotted attribute path such as optparse.Values.read_file is recorded as a plain import, so fickling.load() runs attacker-controlled code even though the safety check reported zero findings. This matters for AI teams because they rely on fickling as a security gate for untrusted model artifacts, and the gate fails silently. The CVSS is 8.8 (network, low complexity, no privileges, user interaction required). There is no KEV listing, no public exploit, no Nuclei template and no EPSS data yet, so exploitation is not yet observed, but the technique is simple and is described in the public advisory. The bypass was confirmed still present on the vendor master branch (commit d011709) as of 2026-10-30, so there is no reliable fixed version. Stop treating fickling's LIKELY_SAFE verdict as sufficient for untrusted pickles: load only trusted artifacts, prefer safetensors or other non-executable formats, and run any unavoidable pickle loading in an isolated sandbox.
Is CVE-2026-118938 actively exploited?
No confirmed active exploitation of CVE-2026-118938 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-118938?
1) Check the fickling project and the PyPI page for a fixed release beyond 0.1.12 and upgrade once one ships; the bypass remained unpatched on master as of 2026-10-30. 2) Do not treat check_safety() output or LIKELY_SAFE as a sufficient gate for untrusted pickles. 3) Prefer non-executable formats (safetensors, ONNX, GGUF) and reject pickle-based artifacts from untrusted sources. 4) If you must load pickles, do it in a sandbox (container or VM with no network, no credentials, read-only filesystem, low privileges) and layer a second scanner such as picklescan. 5) Add allowlist-based unpickling that blocks dotted STACK_GLOBAL names and access to optparse.Values. 6) Detection: search pickle opcodes for STACK_GLOBAL operands that contain dots, alert on optparse references in model files, and monitor ML workers for unexpected exec() or child-process spawning and for outbound connections after model load. 7) Inventory every pipeline that calls fickling.load() or relies on fickling verdicts.
What systems are affected by CVE-2026-118938?
This vulnerability affects the following AI/ML architecture patterns: Model intake and artifact scanning pipelines, Training pipelines, MLOps CI/CD, Model serving, Notebook and research environments, Model registries.
What is the CVSS score for CVE-2026-118938?
CVE-2026-118938 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.48%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0010.003ModelAML.T0011.000Unsafe AI ArtifactsAML.T0018.002Embed MalwareAML.T0074MasqueradingAML.T0107Exploitation for Defense EvasionCompliance Controls Affected
What are the technical details?
Original Advisory
In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example "Values.read_file") is resolved by pickle's find_class through _getattribute to an arbitrary attribute path rather than to a module-level function. Fickling records only the leading component of the name in its import tracking and renders the operation as a plain import (for instance, 'python -m fickling' displays it as 'from optparse import Values.read_file'), so the trailing attribute reference is never analyzed as a call. The OvertlyBadEvals analysis pass does not flag it, and check_safety() returns LIKELY_SAFE with zero findings. This allows an attacker to reach a class method that performs code execution: optparse.Values.read_file executes exec(open(filename).read(), vars), achieving arbitrary code execution when the crafted pickle is loaded through fickling.load(), which chains check_safety() into pickle.loads() as an explicit security gate. optparse is present in all current CPython 3.x releases (deprecated as of Python 3.13, not removed). This weakness is in the resolution and analysis of dotted attribute-path names, and is distinct from and independently fixable from the module-origin trust weakness tracked as CVE-2026-16760: resolving or flagging dotted attribute-path imports closes this vector while leaving the module-level trust behavior unchanged. This bypass was verified to remain present on the vendor master branch at commit d011709 as of 2026-10-30, after the vendor's October blocklist additions and a new heuristic that flags private stdlib attributes; because the public class method Values.read_file is neither blocklisted nor flagged as a private attribute, it is not addressed by those remediations.
Exploitation Scenario
An attacker publishes a plausible-looking model checkpoint on a public hub, or sends it to a target as a shared artifact. The pickle uses a STACK_GLOBAL with the dotted name Values.read_file under optparse and points the file argument at a second attacker-controlled script, or at a file the attacker has planted. The target's intake pipeline runs fickling, which shows zero findings and a LIKELY_SAFE verdict, so the file is approved. When an engineer or automated job calls fickling.load(), pickle.loads() resolves the attribute path and exec() runs the attacker's script. The attacker then steals cloud and registry credentials, exfiltrates datasets, and may tamper with models being built.
Weaknesses (CWE)
CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
- [Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
- [Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HReferences
Timeline
Related Vulnerabilities
CVE-2026-145359.8fickling: shared-state bug disables ML pickle allowlist check
Same package: ficklingCVE-2026-145348.8fickling: denylist gaps let malicious pickles execute
Same package: ficklingGHSA-wccx-j62j-r448fickling: Protection Bypass circumvents security controls
Same package: ficklingGHSA-r48f-3986-4f9cfickling: Allowlist Bypass evades input filtering
Same package: ficklingGHSA-5cxw-w2xg-2m8hfickling: Allowlist Bypass evades input filtering
Same package: fickling