Cloudanix VulnDB

GHSA-5cxw-w2xg-2m8h

Medium · 5.3

fickling's `platform` module subprocess invocation evades `check_safety()` with `LIKELY_SAFE`

CVSS

5.3

EPSS

—

Published

Mar 13, 2026

CISA due date

—

The record

A crafted pickle invoking `platform._syscmd_file`, `platform.architecture`, or `platform.libc_ver` passes `check_safety()` with `Severity.LIKELY_SAFE` and zero findings. During `fickling.loads()`, these functions invoke `subprocess.check_output` with attacker-controlled arguments or read arbitrary files from disk. **Clarification:** The subprocess call uses a list argument (`['file', '-b', target]`), not `shell=True`, so the attacker controls the file path argument to the `file` command, not the command itself. The impact is subprocess invocation with attacker-controlled arguments and information disclosure (file type probing), not arbitrary command injection.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities