CVE-2026-16760

In Trail of Bits fickling through 0.1.12, the processimport method in fickle.py adds an imported name to the likelysafeimports set whenever the source module is present in sys.stdlibmodulenames and the name is absent from the UNSAFEIMPORTS denylist, without inspecting what the name resolves to or...

CVE-2026-16760

The Trail of Bits fickling tool (through version 0.1.12 ) contains a security bypass in the check_safety() function. The _process_import() method in fickle.py incorrectly grants module-level trust to any name from sys.stdlib_module_names not in the UNSAFE_IMPORTS denylist. Because the OvertlyBadE...

CVE-2026-16760 Fickling check_safety() bypass: likely_safe_imports grants module-origin trust to unvalidated standard library callables

In Trail of Bits fickling through 0.1.12, the processimport method in fickle.py adds an imported name to the likelysafeimports set whenever the source module is present in sys.stdlibmodulenames and the name is absent from the UNSAFEIMPORTS denylist, without inspecting what the name resolves to or...