In trailofbits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass calls AnalysisContext.shorten_code(node) on every import node, registering shortened code in a shared set. When the MLAllowlist pass runs, it detects all imports as already reported and skips its allowlist checks entirely. This shared mutable state between the two passes causes MLAllowlist to never evaluate whether an import is in the allowlist, effectively disabling this security check. As a result, any standard library module not explicitly denied can be imported via pickle deserialization while check_safety() returns LIKELY_SAFE, allowing execution of potentially unsafe code through fickling.load().

The vulnerability allows bypassing the MLAllowlist security check, enabling deserialization and execution of potentially unsafe modules via pickle.loads() when using fickling.load(). This can lead to arbitrary code execution with high confidentiality, integrity, and availability impact, as indicated by the CVSS vector. The flaw undermines the intended security gate designed to restrict imports to a known-safe machine learning ecosystem.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using fickling versions up to 0.1.11 in security-sensitive contexts or disable pickle deserialization features that rely on check_safety(). Monitor vendor channels for updates and apply patches once released.