fickling vulnerabilities (PyPI)
16 vulnerabilities.
-
ficklingPyPI Fickling MLAllowlist analysis pass rendered inoperative by shared mutable state in AnalysisContext.shorten_code() 8.8 High -
ficklingPyPI Fickling check_safety() bypass via unlisted standard library modules (_posixsubprocess, site, atexit) 8.8 High -
ficklingPyPI fickling's `platform` module subprocess invocation evades `check_safety()` with `LIKELY_SAFE` 6.9 Medium -
ficklingPyPI fickling modules linecache, difflib and gc are missing from the unsafe modules blocklist 6.9 Medium -
ficklingPyPI Fickling missing RCE-capable modules in UNSAFE_IMPORTS 8.9 High -
ficklingPyPI Fickling has `always_check_safety()` bypass: pickle.loads and _pickle.loads remain unhooked 8.9 High -
ficklingPyPI Fickling has safety check bypass via REDUCE+BUILD opcode sequence 5.3 Medium -
ficklingPyPI Fickling: OBJ opcode call invisibility bypasses all safety checks 8.6 High -
ficklingPyPI Fickling has a detection bypass via stdlib network-protocol constructors 2.3 Low -
ficklingPyPI Fickling vulnerable to detection bypass due to "builtins" blindness 8.9 High -
ficklingPyPI Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist 8.9 High -
ficklingPyPI Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection 8.9 High -
ficklingPyPI Fickling Blocklist Bypass: cProfile.run() 8.9 High -
ficklingPyPI Fickling has a bypass via runpy.run_path() and runpy.run_module() 8.9 High -
ficklingPyPI Fickling has Code Injection vulnerability via pty.spawn() 7.1 High -
ficklingPyPI Fickling has missing detection for marshal.loads and types.FunctionType in unsafe modules list 7.1 High