PT-2026-2226 · Fickling · Fickling

Thomas Chauchefoin

+1

·

Published

2026-01-09

·

Updated

2026-01-10

·

CVE-2026-22606

CVSS v4.0

9.3

Critical

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Fickling versions up to and including 0.1.6
Description Fickling, a Python pickling decompiler and static analyzer, incorrectly classifies pickles utilizing Python’s runpy.run path() or runpy.run module() as SUSPICIOUS instead of OVERTLY MALICIOUS. This misclassification can occur when a user relies on Fickling’s output to determine the safety of pickle deserialization, potentially leading to the execution of attacker-controlled code. This issue impacts any workflow or product that uses Fickling as a security gate for pickle deserialization.
Recommendations Versions prior to 0.1.7 should be updated to version 0.1.7 or later.

Exploit

Fix

Incomplete List of Disallowed Inputs

Deserialization of Untrusted Data

Weakness Enumeration

CWE-184CWE-502

Related Identifiers

CVE-2026-22606
GHSA-WFQ2-52F7-7QVJ

Affected Products

Fickling