Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

fickling

11 known vulnerabilities (11 high), with the versions each affects and the releases that fix them.

Latest release
0.1.13 (Nov 3, 2026): no advisory affects it
Newest unaffected release
0.1.13 (Nov 3, 2026), the latest release
Advisories
11 · 11 high
Weekly downloads
178.9K
Dependents
63
Releases
20 since 0.0.1 (Mar 8, 2021)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 11

  • Fickling check_safety() bypass: dotted qualname in STACK_GLOBAL resolves a class-method attribute path that evades call analysis

    Affected: through 0.1.12.

    Fixed in 0.1.13 (released Nov 3, 2026, 4 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 0.1.13, is not affected.

  • Fickling check_safety() bypass: likely_safe_imports grants module-origin trust to unvalidated standard library callables

    Affected: through 0.1.12.

    Fixed in 0.1.13 (released Nov 3, 2026, 4 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 0.1.13, is not affected.

  • Fickling MLAllowlist analysis pass rendered inoperative by shared mutable state in AnalysisContext.shorten_code()

    Affected: through 0.1.11; fixed in 0.1.12.

    Fixed in 0.1.12 (released Jun 26, 2026, 8 days before disclosure).

    The latest release, 0.1.13, is not affected.

  • Fickling check_safety() bypass via unlisted standard library modules (_posixsubprocess, site, atexit)

    Affected: through 0.1.10; fixed in 0.1.11.

    Fixed in 0.1.11 (released May 6, 2026, 59 days before disclosure).

    The latest release, 0.1.13, is not affected.

  • Fickling vulnerable to detection bypass due to "builtins" blindness

    Affected: fixed in 0.1.7.

    Fixed in 0.1.7 (released Jan 9, 2026, 1 day before disclosure).

    The latest release, 0.1.13, is not affected.

  • Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist

    Affected: fixed in 0.1.7.

    Fixed in 0.1.7 (released Jan 9, 2026, 1 day before disclosure).

    The latest release, 0.1.13, is not affected.

  • Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection

    Affected: fixed in 0.1.7.

    Fixed in 0.1.7 (released Jan 9, 2026, 1 day before disclosure).

    The latest release, 0.1.13, is not affected.

  • Fickling Blocklist Bypass: cProfile.run()

    Affected: fixed in 0.1.7.

    Fixed in 0.1.7 (released Jan 9, 2026, 1 day before disclosure).

    The latest release, 0.1.13, is not affected.

  • Fickling has a bypass via runpy.run_path() and runpy.run_module()

    Affected: fixed in 0.1.7.

    Fixed in 0.1.7 (released Jan 9, 2026, 1 day before disclosure).

    The latest release, 0.1.13, is not affected.

  • Fickling has Code Injection vulnerability via pty.spawn()

    Affected: fixed in 0.1.6.

    Fixed in 0.1.6 (released Dec 15, 2025, 1 day before disclosure).

    The latest release, 0.1.13, is not affected.

  • Fickling has missing detection for marshal.loads and types.FunctionType in unsafe modules list

    Affected: fixed in 0.1.6.

    Fixed in 0.1.6 (released Dec 15, 2025, 1 day before disclosure).

    The latest release, 0.1.13, is not affected.