CVE-2026-14535 is a protection mechanism failure in Trail of Bits fickling, a tool that checks Python pickle files for unsafe content. In versions up to and including 0.1.11, the MLAllowlist pass can be silently skipped, so imports that should be flagged are not. The record scores it 8.8. Upgrade to 0.1.12.
What's affected
- Package:
ficklingon PyPI, from Trail of Bits. - Affected: versions up to and including 0.1.11.
- Fixed: 0.1.12 and later.
- Condition, per the advisory: you run the MLAllowlist analysis pass after another pass in the same analysis context. In that case it fails to flag imports that are not on the allowlist.
- Severity: 8.8 in the record, which lists CWE-693 (protection mechanism failure). GitHub rates the advisory moderate. It is not on the CISA Known Exploited Vulnerabilities list.
The advisory explains that one pass, UnsafeImportsML, marks every import it looks at as already reported, even ones it does not flag. MLAllowlist then sees that mark and skips its own check. The fix makes MLAllowlist work again, and opt in as originally intended.
How to check if you're exposed
Check the installed version in each environment that scans pickles:
pip show fickling
pip list --format=freeze | grep -i fickling
Anything at 0.1.11 or lower is affected. Check requirements files, lockfiles and CI images too, since scanning often runs in a pipeline step rather than on a laptop.
Then look at how your code calls fickling. Search for the analysis entry points and see whether you rely on the allowlist:
grep -rn "MLAllowlist\|check_safety" --include=*.py .
If you never use MLAllowlist, the described bypass does not affect you, though you should still upgrade. If you do, find out where its result gates a decision, such as deciding whether a model file may be loaded.
What to do now
- Upgrade fickling to 0.1.12 or later wherever it is installed, and pin the version in your lockfile.
- If you use the allowlist, follow the advisory's guidance: pass MLAllowlist in the analyzer parameter explicitly when calling check_safety, as the fixed version expects.
- Re-scan any pickle or model files that were approved while you ran 0.1.11 or earlier and relied on the allowlist.
- Prefer formats that cannot run code on load, such as safetensors, for model weights where your tooling allows it.
- Do not treat a safe verdict from any pickle scanner as permission to load files from untrusted sources.
Why it matters
This is a bug in a safety tool, which makes it worth a slow read. A scanner that says a file is safe becomes part of your decision to load it. The record maps the flaw to CWE-693, protection mechanism failure: the check exists, it runs, and it does not do its job.
The advisory describes a shared state problem. Several analysis passes use one context object, and one pass recorded imports as already reported even when it did not flag them. A later pass treated that record as proof the import had been handled and skipped it. Nothing crashed, nothing logged an error, and the result looked like a clean scan. The advisory says the effect is that imports outside the allowlist go unflagged.
The maintainers describe the cause in the advisory without drama, and the repair is small, but the practical lesson is large. Pickle is a format that can run code when loaded. Scanning is a helpful layer for files you have to accept, and it cannot be the only one. Combine it with a source you trust, signatures or hashes for model files, a format that does not execute code, and isolation for anything you must load from outside.
For your own code, shared mutable state between independent checks is a pattern worth looking for in review. A static analysis scan can flag some of it, and tests that run checks in different orders catch more.
Try it yourself
The root cause is shared state in analysis code, the kind of pattern a code scan can flag. This demo shows a static analysis scan.
Click through it at your own pace, or open it full screen.
Quick check
Is the allowlist enabled by default after the fix?
The advisory says the fix makes MLAllowlist functional again and opt in as originally intended, so you pass it explicitly to the analyzer.
Does this mean pickle scanning is useless?
No. It is one layer. The advisory is about a specific check being skipped, and the fix restores it.
Sources
Last reviewed: 19 October 2026.
