{"action":"Upgrade fickling to 0.1.12 or later.","affected":[{"fixed":"0.1.12","introduced":"0"}],"component":"fickling","cve_ids":["CVE-2026-14535"],"ecosystem":"PyPI","epss":0.00564,"exploited":false,"fixed_versions":["0.1.12"],"ghsa_id":"GHSA-cffv-grgg-g429","id":"tcs_01M5KGXRJWZ079E93E2K1AFA8H","modified_at":"2026-07-13T07:15:25.026515566Z","published_at":"2026-07-04T14:16:29.063Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2150","https://github.com/trailofbits/fickling/releases/tag/v0.1.12","https://github.com/trailofbits/fickling/commit/41ce7cb01edd97072994039574a2301ebb3f463d","https://github.com/trailofbits/fickling/pull/278","https://github.com/trailofbits/fickling/security/advisories/GHSA-cffv-grgg-g429"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"PYSEC-2026-2150","url":"https://osv.dev/vulnerability/PYSEC-2026-2150"}],"summary":"In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unconditionally calls AnalysisContext.shorten_code(node) on every import node it inspects, regardless o"}