PT-2026-2228 · Fickling · Fickling

0X-Apollyon · Published 2026-01-09 · Updated 2026-01-10 · CVE-2026-22608

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Fickling versions prior to 0.1.7

Description Fickling, a Python pickling decompiler and static analyzer, does not explicitly block the ctypes and pydoc modules in versions prior to 0.1.7. Combining these modules can lead to Remote Code Execution (RCE), even while the scanner reports the file as LIKELY SAFE. The issue arises because existing pickle scanning tools, such as picklescan, also do not block pydoc.locate.

Recommendations Update to Fickling version 0.1.7 or later.

Exploit

Fix

RCE

Incomplete List of Disallowed Inputs

Deserialization of Untrusted Data

Weakness Enumeration

CWE-184

CWE-502

Related Identifiers

CVE-2026-22608

GHSA-5HVC-6WX8-MVV4

Affected Products

Fickling

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22608.json · Exploit
• 🔥 https://github.com/trailofbits/fickling/security/advisories/GHSA-5hvc-6wx8-mvv4 · Exploit
• https://github.com/trailofbits/fickling/commit/b793563e60a5e039c5837b09d7f4f6b92e6040d1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-22608 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22608 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5hvc-6wx8-mvv4 · Vendor Advisory
• https://github.com/trailofbits/fickling · Note
• https://github.com/trailofbits/fickling/pull/195 · Note
• https://github.com/trailofbits/fickling/commit/d0b00d584afb5c58e38991cd544cb3889de90db6 · Note
• https://github.com/trailofbits/fickling/blob/977b0769c13537cd96549c12bb537f05464cf09c/test/test_bypasses.py#L145 · Note
• https://github.com/trailofbits/fickling/releases/tag/v0.1.7 · Note
• https://t.me/CVEtracker/41904 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2009935833621565918 · Twitter Post
• https://twitter.com/CVEnew/status/2009837437091033500 · Twitter Post