PT-2026-2228 · Fickling · Fickling

0X-Apollyon · CVE-2026-22608 · Published 2026-01-09 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Fickling versions prior to 0.1.7

Description Fickling, a Python pickling decompiler and static analyzer, does not explicitly block the ctypes and pydoc modules in versions prior to 0.1.7. Combining these modules can lead to Remote Code Execution (RCE), even while the scanner reports the file as LIKELY SAFE. The issue arises because existing pickle scanning tools, such as picklescan, also do not block pydoc.locate.

Recommendations Update to Fickling version 0.1.7 or later.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-502

CWE-184

Related Identifiers

CVE-2026-22608

GHSA-5HVC-6WX8-MVV4

PYSEC-2026-1369

Affected Products

Fickling

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22608.json · Exploit
• 🔥 https://github.com/trailofbits/fickling/security/advisories/GHSA-5hvc-6wx8-mvv4 · Exploit
• https://github.com/trailofbits/fickling/commit/b793563e60a5e039c5837b09d7f4f6b92e6040d1 · Patch
• https://osv.dev/vulnerability/CVE-2026-22608 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5hvc-6wx8-mvv4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22608 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-1369 · Vendor Advisory
• https://github.com/trailofbits/fickling/releases/tag/v0.1.7 · Note
• https://github.com/trailofbits/fickling · Note
• https://github.com/trailofbits/fickling/commit/d0b00d584afb5c58e38991cd544cb3889de90db6 · Note
• https://github.com/trailofbits/fickling/pull/195 · Note
• https://github.com/trailofbits/fickling/blob/977b0769c13537cd96549c12bb537f05464cf09c/test/test_bypasses.py#L145 · Note
• https://twitter.com/VulmonFeeds/status/2009935833621565918 · Twitter Post
• https://pypi.org/project/fickling · Note
• https://github.com/advisories/GHSA-5hvc-6wx8-mvv4 · Note