{"id":"GHSA-wccx-j62j-r448","summary":"Fickling has `always_check_safety()` bypass: pickle.loads and _pickle.loads remain unhooked","details":"# Assessment\n\nThe missing pickle entrypoints `pickle.loads`, `_pickle.loads`, and `_pickle.load` were added to the hook https://github.com/trailofbits/fickling/commit/8c24c6edabceab156cfd41f4d70b650e1cdad1f7.\n\n# Original report\n\n## Summary\n`fickling.always_check_safety()` does not hook all pickle entry points. `pickle.loads`, `_pickle.loads`, and `_pickle.load` remain unprotected, enabling malicious payload execution despite global safety mode being enabled.\n\n## Affected versions\n`\u003c= 0.1.8` (verified on current upstream HEAD as of 2026-03-03)\n\n## Non-duplication check against published Fickling GHSAs\nNo published advisory covers hook-coverage bypass in `run_hook()`.\nExisting advisories are blocklist/detection bypasses (runpy, pty, cProfile, marshal/types, builtins, network constructors, OBJ visibility, etc.), not runtime hook coverage parity.\n\n## Root cause\n`run_hook()` patches only:\n- `pickle.load`\n- `pickle.Unpickler`\n- `_pickle.Unpickler`\n\nIt does not patch:\n- `pickle.loads`\n- `_pickle.load`\n- `_pickle.loads`\n\n## Reproduction (clean upstream)\n```python\nimport io, pickle, _pickle\nfrom unittest.mock import patch\nimport fickling\nfrom fickling.exception import UnsafeFileError\n\nclass Payload:\n    def __reduce__(self):\n        import subprocess\n        return (subprocess.Popen, (['echo','BYPASS'],))\n\ndata = pickle.dumps(Payload())\nfickling.always_check_safety()\n\n# Bypass path\nwith patch('subprocess.Popen') as popen_mock:\n    pickle.loads(data)\n    print('bypass sink called?', popen_mock.called)  # True\n\n# Control path is blocked\nwith patch('subprocess.Popen') as popen_mock:\n    try:\n        pickle.load(io.BytesIO(data))\n    except UnsafeFileError:\n        pass\n    print('blocked sink called?', popen_mock.called)  # False\n```\n\nObserved on vulnerable code:\n- `pickle.loads` executes payload\n- `pickle.load` is blocked\n\n## Minimal patch diff\n```diff\n--- a/fickling/hook.py\n+++ b/fickling/hook.py\n@@\n def run_hook():\n-    pickle.load = loader.load\n+    pickle.load = loader.load\n+    _pickle.load = loader.load\n+    pickle.loads = loader.loads\n+    _pickle.loads = loader.loads\n```\n\n## Validation after patch\n- `pickle.loads`, `_pickle.loads`, and `_pickle.load` all raise `UnsafeFileError`\n- sink not called in any path\n\nRegression tests added locally:\n- `test_run_hook_blocks_pickle_loads`\n- `test_run_hook_blocks__pickle_load_and_loads`\n  in `test/test_security_regressions_20260303.py`\n\n## Impact\nHigh-confidence runtime protection bypass for applications that trust `always_check_safety()` as global guard.","modified":"2026-03-04T21:49:54.338830Z","published":"2026-03-04T21:30:16Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-03-04T21:30:16Z","nvd_published_at":null,"cwe_ids":["CWE-693"],"severity":"HIGH"},"references":[{"type":"WEB","url":"https://github.com/trailofbits/fickling/security/advisories/GHSA-wccx-j62j-r448"},{"type":"WEB","url":"https://github.com/trailofbits/fickling/commit/8c24c6edabceab156cfd41f4d70b650e1cdad1f7"},{"type":"PACKAGE","url":"https://github.com/trailofbits/fickling"},{"type":"WEB","url":"https://github.com/trailofbits/fickling/releases/tag/v0.1.9"}],"affected":[{"package":{"name":"fickling","ecosystem":"PyPI","purl":"pkg:pypi/fickling"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.9"}]}],"versions":["0.0.1","0.0.2","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8"],"database_specific":{"last_known_affected_version_range":"\u003c= 0.1.8","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-wccx-j62j-r448/GHSA-wccx-j62j-r448.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P"}]}