CVE-2026-14534: Unsafe Pickle Validation Bypass

How to detect exposure

Start with asset and dependency discovery. Identify whether fickling is installed and if the version is 0.1.10 or earlier. Determine if your codebase uses fickling.load(), check_safety(), or any wrapper that treats LIKELY_SAFE as permission to deserialize untrusted input.

Repository and filesystem reviews are often more reliable than waiting for runtime telemetry. Search Python projects, containers, and virtual environments for explicit imports and pinned dependency versions. If you find fickling==0.1.10 or earlier, review the call path around pickle handling immediately.

Technical Notes

Check installed version:

python -m pip show fickling
python -m pip freeze | grep -i '^fickling=='
pip3 freeze | grep -i '^fickling=='

Search code for potentially risky usage:

grep -RIn "fickling\.load\|check_safety\|pickle\.loads\|pickle\.load" .

Look for dependency declarations pinning affected versions:

grep -RIn "fickling" requirements*.txt pyproject.toml poetry.lock Pipfile* setup.cfg setup.py

Concrete log and detection ideas:

If you have Python application logs around safety checks, look for sequences where a payload was marked safe immediately before deserialization. Patterns like the following are worth reviewing:

check_safety verdict=LIKELY_SAFE findings=0
fickling.load invoked
pickle.loads(...)

If you log process creation from Python services, look for suspicious child processes spawned by services that should only parse data. Since _posixsubprocess.fork_exec is explicitly called out, endpoint telemetry showing unexpected child execution from a pickle-processing service is a significant indicator.

Example Splunk query for Python services that log safety checks and then spawn processes:

index=app_logs ("LIKELY_SAFE" OR "check_safety") OR index=edr_logs process_name=python*
| transaction host maxspan=5m
| search ("LIKELY_SAFE" AND ("fork_exec" OR "execsitecustomize" OR "atexit" OR "child_process" OR "process_start"))

If you do not have application logs for fickling, assume visibility is limited. Prioritize dependency discovery, code review, and EDR process telemetry around systems that deserialize pickle content.

Mitigation and patching

The primary mitigation is to upgrade from affected versions up to and including 0.1.10 to 0.1.11. If fickling is installed from PyPI, update the package directly and redeploy the environment. Ensure your lockfiles and build pipelines also pin the corrected version to avoid reintroducing the vulnerable release.

If immediate patching is not possible, the safest workaround is to stop treating fickling as a sufficient security gate for untrusted pickle content. This means do not deserialize untrusted pickle data at all, even when check_safety() returns LIKELY_SAFE. Quarantine inbound pickle files, require provenance validation, or switch to a safer serialization format.

A temporary defense-in-depth step is to add a policy layer that rejects payloads referencing _posixsubprocess, site, or atexit, and to disable or isolate any automated processing pipeline that loads external pickle blobs. Remember, this is a workaround, not a replacement for patching, as denylist-based controls should not be the only protection.

Technical Notes

Upgrade command:

python -m pip install --upgrade "fickling==0.1.11"

If you manage dependencies via a requirements file:

sed -i.bak 's/^fickling==.*/fickling==0.1.11/' requirements.txt
python -m pip install -r requirements.txt

If you need an immediate code-level workaround, block deserialization when safety results are the only control:

from fickling import check_safety
import pickle

def reject_untrusted_pickle(data: bytes):
    result = check_safety(data)
    # Temporary hardening: do not trust a positive verdict as permission to load.
    raise RuntimeError(
        "Untrusted pickle deserialization disabled until fickling is upgraded to 0.1.11+"
    )

# Do not call pickle.loads(data) on untrusted input.

Operational workaround: - Disable upload or ingestion paths for pickle artifacts from untrusted sources. - Restrict egress and process spawning on systems that must temporarily inspect pickle data. - Rebuild containers and serverless packages after updating the dependency, not just the source tree.

References

The following references are associated with this vulnerability and remediation:

The NVD record is the authoritative public source for the vulnerability summary used here. Some details such as the exact CVSS vector and confirmed exploitation telemetry were not available in the provided source data.