CVE-2026-16760

{
  "id": "CVE-2026-16760",
  "sourceIdentifier": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082",
  "published": "2026-10-30T22:16:54.193",
  "lastModified": "2026-10-30T22:16:54.193",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the likely_safe_imports set whenever the source module is present in sys.stdlib_module_names and the name is absent from the UNSAFE_IMPORTS denylist, without inspecting what the name resolves to or how it behaves. The OvertlyBadEvals analysis pass in analysis.py then unconditionally skips any call whose function name appears in likely_safe_imports, including calls that would otherwise be flagged as overtly dangerous. As a result, any callable reachable through a non-blocked standard library module inherits module-level trust regardless of its own behavior, and check_safety() returns LIKELY_SAFE with zero findings for pickle payloads that reach code execution or file write through such callables. Demonstrated primitives: dataclasses._create_fn, which passes an attacker-controlled function body to exec() and yields arbitrary code execution on Python 3.7 through 3.12 (the internal _create_fn function was removed in Python 3.13); mailcap.findmatch, which internally calls os.system() on a test command taken from an attacker-controlled caps dictionary, yielding arbitrary code execution on Python versions through 3.12 (the mailcap module was removed in Python 3.13); and readline.add_history() followed by readline.write_history_file(), which writes attacker-controlled content to an arbitrary filesystem path (POSIX platforms, where the readline module is available). fickling.load() chains check_safety() into pickle.loads() as an explicit security gate, so a LIKELY_SAFE verdict causes the payload to be deserialized and executed with the privileges of the victim process. The root cause is the inference of callable safety from module origin; it is independent of, and separately fixable from, the dotted __qualname__ resolution weakness tracked as CVE-2026-118938, which this advisory does not address. As of 2026-10-30 the three demonstrated modules were added to UNSAFE_IMPORTS on the vendor master branch (commit d011709) pending release; released versions through 0.1.12 remain affected, and the module-origin trust root cause persists, as demonstrated by the related CVE-2026-118938 remaining exploitable on that same build."
    }
  ],
  "affected": [
    {
      "source": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082",
      "affectedData": [
        {
          "vendor": "trailofbits",
          "product": "fickling",
          "defaultStatus": "unaffected",
          "collectionURL": "https://pypi.org/project/fickling/",
          "packageName": "fickling",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "0.1.12",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ]
  },
  "weaknesses": [
    {
      "source": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        },
        {
          "lang": "en",
          "value": "CWE-693"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://bombadil.systems/advisories.html",
      "source": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082"
    },
    {
      "url": "https://github.com/trailofbits/fickling",
      "source": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082"
    },
    {
      "url": "https://github.com/trailofbits/fickling/commit/d011709",
      "source": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082"
    },
    {
      "url": "https://pypi.org/project/fickling/0.1.12/",
      "source": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082"
    }
  ]
}