PT-2026-2229 · Fickling · Fickling

Mldangelo · Published 2026-01-09 · Updated 2026-01-10 · CVE-2026-22609

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Fickling versions prior to 0.1.7

Description Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, the unsafe imports() method within Fickling’s static analyzer does not identify several high-risk Python modules that could be used for arbitrary code execution. This allows malicious pickles importing these modules to bypass Fickling’s safety checks.

Recommendations Update Fickling to version 0.1.7 or later.

Exploit

Fix

Incomplete List of Disallowed Inputs

Deserialization of Untrusted Data

Weakness Enumeration

CWE-184

CWE-502

Related Identifiers

CVE-2026-22609

GHSA-Q5QQ-MVFM-J35X

Affected Products

Fickling

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22609.json · Exploit
• 🔥 https://github.com/trailofbits/fickling/security/advisories/GHSA-q5qq-mvfm-j35x · Exploit
• https://github.com/trailofbits/fickling/commit/b793563e60a5e039c5837b09d7f4f6b92e6040d1 · Patch
• https://github.com/trailofbits/fickling/commit/eb299b453342f1931c787bcb3bc33f3a03a173f9 · Patch
• https://github.com/trailofbits/fickling/commit/29d5545e74b07766892c1f0461b801afccee4f91 · Patch
• https://github.com/trailofbits/fickling/commit/9a2b3f89bd0598b528d62c10a64c1986fcb09f66 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-22609 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22609 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q5qq-mvfm-j35x · Vendor Advisory
• https://github.com/trailofbits/fickling · Note
• https://github.com/trailofbits/fickling/pull/195 · Note
• https://github.com/trailofbits/fickling/blob/977b0769c13537cd96549c12bb537f05464cf09c/test/test_bypasses.py#L88 · Note
• https://github.com/trailofbits/fickling/commit/6b400e1a2525e6a4a076c97ccc0d4d9581317101 · Note
• https://github.com/trailofbits/fickling/releases/tag/v0.1.7 · Note
• https://twitter.com/CVEnew/status/2009837436180857264 · Twitter Post