PT-2026-2229 · Fickling · Fickling

Mldangelo · CVE-2026-22609 · Published 2026-01-09 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Fickling versions prior to 0.1.7

Description Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, the unsafe imports() method within Fickling’s static analyzer does not identify several high-risk Python modules that could be used for arbitrary code execution. This allows malicious pickles importing these modules to bypass Fickling’s safety checks.

Recommendations Update Fickling to version 0.1.7 or later.

Exploit

Fix

Deserialization of Untrusted Data

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-502

CWE-184

Related Identifiers

CVE-2026-22609

GHSA-Q5QQ-MVFM-J35X

PYSEC-2026-1372

Affected Products

Fickling

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22609.json · Exploit
• 🔥 https://github.com/trailofbits/fickling/security/advisories/GHSA-q5qq-mvfm-j35x · Exploit
• https://github.com/trailofbits/fickling/commit/9a2b3f89bd0598b528d62c10a64c1986fcb09f66 · Patch
• https://github.com/trailofbits/fickling/commit/eb299b453342f1931c787bcb3bc33f3a03a173f9 · Patch
• https://github.com/trailofbits/fickling/commit/29d5545e74b07766892c1f0461b801afccee4f91 · Patch
• https://github.com/trailofbits/fickling/commit/b793563e60a5e039c5837b09d7f4f6b92e6040d1 · Patch
• https://osv.dev/vulnerability/CVE-2026-22609 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q5qq-mvfm-j35x · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-1372 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22609 · Security Note
• https://github.com/trailofbits/fickling/commit/6b400e1a2525e6a4a076c97ccc0d4d9581317101 · Note
• https://github.com/trailofbits/fickling/releases/tag/v0.1.7 · Note
• https://github.com/trailofbits/fickling · Note
• https://github.com/trailofbits/fickling/blob/977b0769c13537cd96549c12bb537f05464cf09c/test/test_bypasses.py#L88 · Note
• https://github.com/trailofbits/fickling/pull/195 · Note