{"action":"Upgrade fickling to 0.1.9 or later.","affected":[{"fixed":"0.1.9","introduced":"0"}],"component":"fickling","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":["0.1.9"],"ghsa_id":"GHSA-wccx-j62j-r448","id":"tcs_01M5KG1YQVEEN26J2K61S8VTRA","modified_at":"2026-03-04T21:49:54.338830Z","published_at":"2026-03-04T21:30:16Z","references":["https://osv.dev/vulnerability/GHSA-wccx-j62j-r448","https://github.com/trailofbits/fickling/security/advisories/GHSA-wccx-j62j-r448","https://github.com/trailofbits/fickling/commit/8c24c6edabceab156cfd41f4d70b650e1cdad1f7","https://github.com/trailofbits/fickling","https://github.com/trailofbits/fickling/releases/tag/v0.1.9"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-wccx-j62j-r448","url":"https://osv.dev/vulnerability/GHSA-wccx-j62j-r448"}],"summary":"Fickling has `always_check_safety()` bypass: pickle.loads and _pickle.loads remain unhooked"}