Vulnerability details
CVE-2026-22609
trailofbits fickling
Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist
CVSS 4.0
8.9High
Official description
Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, the unsafe_imports() method in Fickling's static analyzer fails to flag several high-risk Python modules that can be used for arbitrary code execution. Malicious pickles importing these modules will not be detected as unsafe, allowing attackers to bypass Fickling's primary static safety checks. This issue has been patched in version 0.1.7.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.9High | 4.0 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| trailofbits | fickling | < 0.1.7 | CVEProject cvelistV5 (CNA) |
References and advisories
6- https://github.com/trailofbits/fickling/commit/29d5545e74b07766892c1f0461b801afccee4f91 x_refsource_MISC
- https://github.com/trailofbits/fickling/commit/9a2b3f89bd0598b528d62c10a64c1986fcb09f66 x_refsource_MISC
- https://github.com/trailofbits/fickling/commit/b793563e60a5e039c5837b09d7f4f6b92e6040d1 x_refsource_MISC
- https://github.com/trailofbits/fickling/commit/eb299b453342f1931c787bcb3bc33f3a03a173f9 x_refsource_MISC
- https://github.com/trailofbits/fickling/releases/tag/v0.1.7 x_refsource_MISC
- https://github.com/trailofbits/fickling/security/advisories/GHSA-q5qq-mvfm-j35x x_refsource_CONFIRM
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-01-10
- Last updated
- 2026-01-14
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.62%
Probability of exploitation in 30 days
50.3%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Proof of concept
- Technical impact
- Total
Weaknesses (CWE)
- CWE-184Incomplete List of Disallowed Inputs
- CWE-502Deserialization of Untrusted Data