CVE-2026-16760

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-16760", "assignerOrgId": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082", "state": "PUBLISHED", "assignerShortName": "BombadilSystems", "dateReserved": "2026-07-23T14:00:36.878Z", "datePublished": "2026-10-30T21:16:31.353Z", "dateUpdated": "2026-11-06T16:01:12.427Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082", "shortName": "BombadilSystems", "dateUpdated": "2026-10-30T21:16:31.353Z"}, "title": "Fickling check_safety() bypass: likely_safe_imports grants module-origin trust to unvalidated standard library callables", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-693", "description": "CWE-693 Protection Mechanism Failure", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "An attacker can craft a malicious pickle that invokes a dangerous callable imported from a standard library module not present in UNSAFE_IMPORTS. The name is added to likely_safe_imports by _process_import(), causing OvertlyBadEvals to skip the call, so check_safety() returns LIKELY_SAFE and fickling.load() proceeds to deserialize the payload. This yields arbitrary code execution via dataclasses._create_fn or mailcap.findmatch on Python versions through 3.12, and arbitrary file write with attacker-controlled content via readline.write_history_file on POSIX platforms across supported Python versions. Because the flaw is in the module-origin trust model rather than in any specific module list, adding the demonstrated modules to UNSAFE_IMPORTS does not address the root cause; additional dangerous callables remain reachable through other non-blocked standard library modules."}]}], "affected": [{"vendor": "trailofbits", "product": "fickling", "collectionURL": "https://pypi.org/project/fickling/", "packageName": "fickling", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "0.1.12", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the likely_safe_imports set whenever the source module is present in sys.stdlib_module_names and the name is absent from the UNSAFE_IMPORTS denylist, without inspecting what the name resolves to or how it behaves. The OvertlyBadEvals analysis pass in analysis.py then unconditionally skips any call whose function name appears in likely_safe_imports, including calls that would otherwise be flagged as overtly dangerous. As a result, any callable reachable through a non-blocked standard library module inherits module-level trust regardless of its own behavior, and check_safety() returns LIKELY_SAFE with zero findings for pickle payloads that reach code execution or file write through such callables. Demonstrated primitives: dataclasses._create_fn, which passes an attacker-controlled function body to exec() and yields arbitrary code execution on Python 3.7 through 3.12 (the internal _create_fn function was removed in Python 3.13); mailcap.findmatch, which internally calls os.system() on a test command taken from an attacker-controlled caps dictionary, yielding arbitrary code execution on Python versions through 3.12 (the mailcap module was removed in Python 3.13); and readline.add_history() followed by readline.write_history_file(), which writes attacker-controlled content to an arbitrary filesystem path (POSIX platforms, where the readline module is available). fickling.load() chains check_safety() into pickle.loads() as an explicit security gate, so a LIKELY_SAFE verdict causes the payload to be deserialized and executed with the privileges of the victim process. The root cause is the inference of callable safety from module origin; it is independent of, and separately fixable from, the dotted __qualname__ resolution weakness tracked as CVE-2026-118938, which this advisory does not address. As of 2026-10-30 the three demonstrated modules were added to UNSAFE_IMPORTS on the vendor master branch (commit d011709) pending release; released versions through 0.1.12 remain affected, and the module-origin trust root cause persists, as demonstrated by the related CVE-2026-118938 remaining exploitable on that same build.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the likely_safe_imports set whenever the source module is present in sys.stdlib_module_names and the name is absent from the UNSAFE_IMPORTS denylist, without inspecting what the name resolves to or how it behaves. The OvertlyBadEvals analysis pass in analysis.py then unconditionally skips any call whose function name appears in likely_safe_imports, including calls that would otherwise be flagged as overtly dangerous. As a result, any callable reachable through a non-blocked standard library module inherits module-level trust regardless of its own behavior, and check_safety() returns LIKELY_SAFE with zero findings for pickle payloads that reach code execution or file write through such callables. Demonstrated primitives: dataclasses._create_fn, which passes an attacker-controlled function body to exec() and yields arbitrary code execution on Python 3.7 through 3.12 (the internal _create_fn function was removed in Python 3.13); mailcap.findmatch, which internally calls os.system() on a test command taken from an attacker-controlled caps dictionary, yielding arbitrary code execution on Python versions through 3.12 (the mailcap module was removed in Python 3.13); and readline.add_history() followed by readline.write_history_file(), which writes attacker-controlled content to an arbitrary filesystem path (POSIX platforms, where the readline module is available). fickling.load() chains check_safety() into pickle.loads() as an explicit security gate, so a LIKELY_SAFE verdict causes the payload to be deserialized and executed with the privileges of the victim process. The root cause is the inference of callable safety from module origin; it is independent of, and separately fixable from, the dotted __qualname__ resolution weakness tracked as CVE-2026-118938, which this advisory does not address. As of 2026-10-30 the three demonstrated modules were added to UNSAFE_IMPORTS on the vendor master branch (commit d011709) pending release; released versions through 0.1.12 remain affected, and the module-origin trust root cause persists, as demonstrated by the related CVE-2026-118938 remaining exploitable on that same build.</p>"}]}], "references": [{"url": "https://bombadil.systems/advisories.html", "name": "Bombadil Systems advisory listing"}, {"url": "https://pypi.org/project/fickling/0.1.12/", "name": "fickling 0.1.12 on PyPI"}, {"url": "https://github.com/trailofbits/fickling", "name": "fickling source repository"}, {"url": "https://github.com/trailofbits/fickling/commit/d011709", "name": "Vendor remediation merge commit d011709 (adds readline, dataclasses, and mailcap to UNSAFE_IMPORTS on master; the module-origin trust root cause remains)"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "value": "Christopher Aziz (Bombadil Systems LLC)", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-06T16:00:50.929044Z", "id": "CVE-2026-16760", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T16:01:12.427Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-16760", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-06T16:00:50.929044Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T16:01:06.032Z"}}], "cna": {"title": "Fickling check_safety() bypass: likely_safe_imports grants module-origin trust to unvalidated standard library callables", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Christopher Aziz (Bombadil Systems LLC)"}], "impacts": [{"descriptions": [{"lang": "en", "value": "An attacker can craft a malicious pickle that invokes a dangerous callable imported from a standard library module not present in UNSAFE_IMPORTS. The name is added to likely_safe_imports by _process_import(), causing OvertlyBadEvals to skip the call, so check_safety() returns LIKELY_SAFE and fickling.load() proceeds to deserialize the payload. This yields arbitrary code execution via dataclasses._create_fn or mailcap.findmatch on Python versions through 3.12, and arbitrary file write with attacker-controlled content via readline.write_history_file on POSIX platforms across supported Python versions. Because the flaw is in the module-origin trust model rather than in any specific module list, adding the demonstrated modules to UNSAFE_IMPORTS does not address the root cause; additional dangerous callables remain reachable through other non-blocked standard library modules."}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "trailofbits", "product": "fickling", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "0.1.12"}], "packageName": "fickling", "collectionURL": "https://pypi.org/project/fickling/", "defaultStatus": "unaffected"}], "references": [{"url": "https://bombadil.systems/advisories.html", "name": "Bombadil Systems advisory listing"}, {"url": "https://pypi.org/project/fickling/0.1.12/", "name": "fickling 0.1.12 on PyPI"}, {"url": "https://github.com/trailofbits/fickling", "name": "fickling source repository"}, {"url": "https://github.com/trailofbits/fickling/commit/d011709", "name": "Vendor remediation merge commit d011709 (adds readline, dataclasses, and mailcap to UNSAFE_IMPORTS on master; the module-origin trust root cause remains)"}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the likely_safe_imports set whenever the source module is present in sys.stdlib_module_names and the name is absent from the UNSAFE_IMPORTS denylist, without inspecting what the name resolves to or how it behaves. The OvertlyBadEvals analysis pass in analysis.py then unconditionally skips any call whose function name appears in likely_safe_imports, including calls that would otherwise be flagged as overtly dangerous. As a result, any callable reachable through a non-blocked standard library module inherits module-level trust regardless of its own behavior, and check_safety() returns LIKELY_SAFE with zero findings for pickle payloads that reach code execution or file write through such callables. Demonstrated primitives: dataclasses._create_fn, which passes an attacker-controlled function body to exec() and yields arbitrary code execution on Python 3.7 through 3.12 (the internal _create_fn function was removed in Python 3.13); mailcap.findmatch, which internally calls os.system() on a test command taken from an attacker-controlled caps dictionary, yielding arbitrary code execution on Python versions through 3.12 (the mailcap module was removed in Python 3.13); and readline.add_history() followed by readline.write_history_file(), which writes attacker-controlled content to an arbitrary filesystem path (POSIX platforms, where the readline module is available). fickling.load() chains check_safety() into pickle.loads() as an explicit security gate, so a LIKELY_SAFE verdict causes the payload to be deserialized and executed with the privileges of the victim process. The root cause is the inference of callable safety from module origin; it is independent of, and separately fixable from, the dotted __qualname__ resolution weakness tracked as CVE-2026-118938, which this advisory does not address. As of 2026-10-30 the three demonstrated modules were added to UNSAFE_IMPORTS on the vendor master branch (commit d011709) pending release; released versions through 0.1.12 remain affected, and the module-origin trust root cause persists, as demonstrated by the related CVE-2026-118938 remaining exploitable on that same build.", "supportingMedia": [{"type": "text/html", "value": "<p>In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the likely_safe_imports set whenever the source module is present in sys.stdlib_module_names and the name is absent from the UNSAFE_IMPORTS denylist, without inspecting what the name resolves to or how it behaves. The OvertlyBadEvals analysis pass in analysis.py then unconditionally skips any call whose function name appears in likely_safe_imports, including calls that would otherwise be flagged as overtly dangerous. As a result, any callable reachable through a non-blocked standard library module inherits module-level trust regardless of its own behavior, and check_safety() returns LIKELY_SAFE with zero findings for pickle payloads that reach code execution or file write through such callables. Demonstrated primitives: dataclasses._create_fn, which passes an attacker-controlled function body to exec() and yields arbitrary code execution on Python 3.7 through 3.12 (the internal _create_fn function was removed in Python 3.13); mailcap.findmatch, which internally calls os.system() on a test command taken from an attacker-controlled caps dictionary, yielding arbitrary code execution on Python versions through 3.12 (the mailcap module was removed in Python 3.13); and readline.add_history() followed by readline.write_history_file(), which writes attacker-controlled content to an arbitrary filesystem path (POSIX platforms, where the readline module is available). fickling.load() chains check_safety() into pickle.loads() as an explicit security gate, so a LIKELY_SAFE verdict causes the payload to be deserialized and executed with the privileges of the victim process. The root cause is the inference of callable safety from module origin; it is independent of, and separately fixable from, the dotted __qualname__ resolution weakness tracked as CVE-2026-118938, which this advisory does not address. As of 2026-10-30 the three demonstrated modules were added to UNSAFE_IMPORTS on the vendor master branch (commit d011709) pending release; released versions through 0.1.12 remain affected, and the module-origin trust root cause persists, as demonstrated by the related CVE-2026-118938 remaining exploitable on that same build.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-693", "description": "CWE-693 Protection Mechanism Failure"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082", "shortName": "BombadilSystems", "dateUpdated": "2026-10-30T21:16:31.353Z"}}}, "cveMetadata": {"cveId": "CVE-2026-16760", "state": "PUBLISHED", "dateUpdated": "2026-11-06T16:01:12.427Z", "dateReserved": "2026-07-23T14:00:36.878Z", "assignerOrgId": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082", "datePublished": "2026-10-30T21:16:31.353Z", "assignerShortName": "BombadilSystems"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://pypi.org/project/fickling/", "defaultStatus": "unaffected", "packageName": "fickling", "product": "fickling", "vendor": "trailofbits", "versions": [{"lessThanOrEqual": "0.1.12", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the likely_safe_imports set whenever the source module is present in sys.stdlib_module_names and the name is absent from the UNSAFE_IMPORTS denylist, without inspecting what the name resolves to or how it behaves. The OvertlyBadEvals analysis pass in analysis.py then unconditionally skips any call whose function name appears in likely_safe_imports, including calls that would otherwise be flagged as overtly dangerous. As a result, any callable reachable through a non-blocked standard library module inherits module-level trust regardless of its own behavior, and check_safety() returns LIKELY_SAFE with zero findings for pickle payloads that reach code execution or file write through such callables. Demonstrated primitives: dataclasses._create_fn, which passes an attacker-controlled function body to exec() and yields arbitrary code execution on Python 3.7 through 3.12 (the internal _create_fn function was removed in Python 3.13); mailcap.findmatch, which internally calls os.system() on a test command taken from an attacker-controlled caps dictionary, yielding arbitrary code execution on Python versions through 3.12 (the mailcap module was removed in Python 3.13); and readline.add_history() followed by readline.write_history_file(), which writes attacker-controlled content to an arbitrary filesystem path (POSIX platforms, where the readline module is available). fickling.load() chains check_safety() into pickle.loads() as an explicit security gate, so a LIKELY_SAFE verdict causes the payload to be deserialized and executed with the privileges of the victim process. The root cause is the inference of callable safety from module origin; it is independent of, and separately fixable from, the dotted __qualname__ resolution weakness tracked as CVE-2026-118938, which this advisory does not address. As of 2026-10-30 the three demonstrated modules were added to UNSAFE_IMPORTS on the vendor master branch (commit d011709) pending release; released versions through 0.1.12 remain affected, and the module-origin trust root cause persists, as demonstrated by the related CVE-2026-118938 remaining exploitable on that same build."}], "id": "CVE-2026-16760", "lastModified": "2026-11-06T16:17:55.797", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-16760", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T16:00:50.929044Z", "version": "2.0.3"}}]}, "published": "2026-10-30T22:16:54.193", "references": [{"source": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082", "url": "https://bombadil.systems/advisories.html"}, {"source": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082", "url": "https://github.com/trailofbits/fickling"}, {"source": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082", "url": "https://github.com/trailofbits/fickling/commit/d011709"}, {"source": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082", "url": "https://pypi.org/project/fickling/0.1.12/"}], "sourceIdentifier": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}, {"lang": "en", "value": "CWE-693"}], "source": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082", "type": "Secondary"}]}

{"bugzilla": {"description": "fickling: fickling: Arbitrary code execution via safety check bypass", "id": "2564323", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2564323"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-502", "details": ["A flaw was found in fickling. This flaw allows arbitrary code execution when an application processes untrusted serialized data. Because fickling inherently trusts unblocked standard library functions without verifying their actual behavior, it fails to identify dangerous calls within serialized files. A remote attacker could exploit this vulnerability by providing a specially crafted pickle payload that bypasses security checks, executing commands or modifying files with the privileges of the running application."], "name": "CVE-2026-16760", "package_state": [{"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-th-torch-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-th-torch-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-10-30T21:16:31Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-16760\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-16760\nhttps://bombadil.systems/advisories.html\nhttps://github.com/trailofbits/fickling\nhttps://github.com/trailofbits/fickling/commit/d011709\nhttps://pypi.org/project/fickling/0.1.12/"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.1.12]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "fickling", "source": "cna", "vendor": "trailofbits"}, "product": "fickling", "vendor": "trailofbits"}], "created": "2026-10-30T22:30:13.722749+00:00", "updated": "2026-10-30T22:30:14.369078+00:00", "vendors": ["trailofbits", "trailofbits$PRODUCT$fickling"]}