CVE-2026-14534
1 advisory.
PyPI/fickling CVE-2026-14534: high 8.8
Trail of Bits fickling versions up to and including 0.1.10 do not include the Python standard library modules _posixsubprocess, site, and atexit in the UNSAFE_IMPORTS denylist (fickle.py). Because the
Action: Upgrade fickling to 0.1.11 or later.
pip install fickling==0.1.11Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.1.11 | - |
Fixed versions
| 0.1.11 |
Sources
- osv: PYSEC-2026-2149
- https://github.com/trailofbits/fickling/releases/tag/v0.1.11
- https://github.com/trailofbits/fickling/commit/e8408615b63adf034f891f653692ab9b51f0f5af
- https://github.com/trailofbits/fickling/pull/272
- https://github.com/trailofbits/fickling/security/advisories/GHSA-m6fh-58r7-x697
CVE-2026-14534 · published · modified · JSON