Threats tagged 'ghsa-6jfm-qx2v-27jg'

A vulnerability in the Python package 'fickling' version 0.1.12 allows arbitrary code execution via a crafted pickle containing a STACK_GLOBAL operand with a dotted __qualname__. The flaw arises because the pickle's find_class resolves dotted attribute paths to arbitrary attributes rather than restricting to module-level functions, bypassing the security checks in fickling.load(). This enables execution of the optparse.Values.read_file method, which executes code from a file. The issue is distinct from other module-origin trust weaknesses and remains unpatched as of the latest vendor commit in October 2026.