PT-2026-2227 · Fickling · Fickling

Thomas Chaufein + 1 · Published 2026-01-09 · Updated 2026-01-11 · CVE-2026-22607

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Fickling versions up to and including 0.1.6

Description Fickling, a Python pickling decompiler and static analyzer, incorrectly classifies pickles utilizing the cProfile.run() function as SUSPICIOUS instead of OVERTLY MALICIOUS. This misclassification can lead users to execute attacker-controlled code if they rely on Fickling’s output to determine pickle safety for deserialization. This issue impacts any workflow or product using Fickling as a security gate for pickle deserialization.

Recommendations Versions up to and including 0.1.6 should be updated to version 0.1.7 or later.

Exploit

Fix

Incomplete List of Disallowed Inputs

Deserialization of Untrusted Data

Weakness Enumeration

CWE-184

CWE-502

Related Identifiers

CVE-2026-22607

GHSA-P523-JQ9W-64X9

Affected Products

Fickling

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22607.json · Exploit
• 🔥 https://github.com/trailofbits/fickling/security/advisories/GHSA-p523-jq9w-64x9 · Exploit
• https://github.com/trailofbits/fickling/commit/dc8ae12966edee27a78fe05c5745171a2b138d43 · Patch
• https://osv.dev/vulnerability/GHSA-p523-jq9w-64x9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-22607 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22607 · Security Note
• https://github.com/trailofbits/fickling · Note
• https://github.com/trailofbits/fickling/security/advisories/GHSA-r7v6-mfhq-g3m2 · Note
• https://github.com/trailofbits/fickling/pull/108 · Note
• https://github.com/trailofbits/fickling/pull/187 · Note
• https://github.com/trailofbits/fickling/pull/195 · Note
• https://github.com/trailofbits/fickling/blob/977b0769c13537cd96549c12bb537f05464cf09c/test/test_bypasses.py#L116 · Note
• https://github.com/trailofbits/fickling/releases/tag/v0.1.7 · Note
• https://github.com/trailofbits/fickling/security/advisories/GHSA-565g-hwwr-4pp3 · Note
• https://twitter.com/CVEnew/status/2009837438076584204 · Twitter Post