PT-2026-2226 · Fickling · Fickling
CVSS v4.0
9.3
Critical
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Fickling versions up to and including 0.1.6
Description
Fickling, a Python pickling decompiler and static analyzer, incorrectly classifies pickles utilizing Python’s
runpy.run path() or runpy.run module() as SUSPICIOUS instead of OVERTLY MALICIOUS. This misclassification can occur when a user relies on Fickling’s output to determine the safety of pickle deserialization, potentially leading to the execution of attacker-controlled code. This issue impacts any workflow or product that uses Fickling as a security gate for pickle deserialization.Recommendations
Versions prior to 0.1.7 should be updated to version 0.1.7 or later.
Exploit
Fix
Deserialization of Untrusted Data
Incomplete List of Disallowed Inputs
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Fickling