{"action":"Upgrade fickling to 0.1.11 or later.","affected":[{"fixed":"0.1.11","introduced":"0"}],"component":"fickling","cve_ids":["CVE-2026-14534"],"ecosystem":"PyPI","epss":0.00594,"exploited":false,"fixed_versions":["0.1.11"],"ghsa_id":"GHSA-m6fh-58r7-x697","id":"tcs_01M5KGXR9SMBG6DGF0P5PS8WG5","modified_at":"2026-07-13T07:15:25.024533172Z","published_at":"2026-07-04T14:16:28.400Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2149","https://github.com/trailofbits/fickling/releases/tag/v0.1.11","https://github.com/trailofbits/fickling/commit/e8408615b63adf034f891f653692ab9b51f0f5af","https://github.com/trailofbits/fickling/pull/272","https://github.com/trailofbits/fickling/security/advisories/GHSA-m6fh-58r7-x697"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"PYSEC-2026-2149","url":"https://osv.dev/vulnerability/PYSEC-2026-2149"}],"summary":"Trail of Bits fickling versions up to and including 0.1.10 do not include the Python standard library modules _posixsubprocess, site, and atexit in the UNSAFE_IMPORTS denylist (fickle.py). Because the"}