CVE-2026-118938 - Fickling check_safety() bypass: dotted __qualname__ in STACK_GLOBAL resolves a class-method attribute path that evades call analysis
CVE ID :CVE-2026-118938 Published : Oct. 30, 2026, 9:19 p.m. | 42 minutes ago Description :In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example "Values.read_file") is resolved by pickle's find_class through _getattribute to an...