GHSA-r48f-3986-4f9c

# Our analysis As stated in the [project's security policy](https://github.com/trailofbits/fickling/security/policy), we also don't consider `UnusedVariables` bypasses to be security issues. We added several unsafe modules mentioned by the reporter in advisory comments to the blocklist (https://github.com/trailofbits/fickling/commit/7f39d97258217ee2c21a1f5031d4a6d7343eb30d). # Original report Title: UnusedVariables analysis bypass via BUILD opcode Arbitrary File Read through fickling.load() ### Summary Two independent bugs in fickling's AST-based static analysis combine to allow a malicious pickle file to execute arbitrary stdlib function calls - including reading sensitive files - while check_safety() returns Severity.LIKELY_SAFE and fickling.load() completes without raising UnsafeFileError. A server using fickling.load() as a security gate before deserializing untrusted pickle data (its documented use case) is fully bypassed. The attacker receives the contents of any file readable by the server process as the return value of fickling.load(). ### Details Interpreter.unused_assignments() does not scan the result assignment's RHS File: fickling/fickle.py, Interpreter.unused_assignments(), ~line 1242 ```python for statement in self.module_body: if isinstance(statement, ast.Assign): if ( len(statement.targets) == 1 and isinstance(statement.targets[0], ast.Name) and statement.targets[0].id == "result" ): break ... statement = statement.value if statement is not None: for node in ast.walk(statement): if isinstance(node, ast.Name): used.add(node.id) ``` When the loop reaches result = _varN, it breaks immediately. The right-hand side of the result assignment is never walked for variable references. Any variable whose only reference is inside the result expression is therefore never added to the used set and is incorrectly flagged as unused -