EUVD-2026-114515

In Trail of Bits fickling through 0.1.12, a pickle STACKGLOBAL operand carrying a dotted qualname for example "Values.readfile" is resolved by pickle's findclass through getattribute to an arbitrary attribute path rather than to a module-level function. Fickling records only the leading component...

CVE-2026-118938

The Trail of Bits fickling library (through version 0.1.12 ) contains a security bypass in its check_safety() function. The root cause is the improper resolution of dotted qualname values in STACK_GLOBAL operands. Specifically, find_class resolves these to arbitrary attribute paths (e.g., Values....

CVE-2026-118938 Fickling check_safety() bypass: dotted __qualname__ in STACK_GLOBAL resolves a class-method attribute path that evades call analysis

In Trail of Bits fickling through 0.1.12, a pickle STACKGLOBAL operand carrying a dotted qualname for example "Values.readfile" is resolved by pickle's findclass through getattribute to an arbitrary attribute path rather than to a module-level function. Fickling records only the leading component...