CVE-2026-22609

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-22609
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22609.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-22609
Aliases
Published
2026-01-10T01:35:18.152Z
Modified
2026-03-13T04:08:07.697857Z
Severity
  • 8.9 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist
Details

Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, the unsafe_imports() method in Fickling's static analyzer fails to flag several high-risk Python modules that can be used for arbitrary code execution. Malicious pickles importing these modules will not be detected as unsafe, allowing attackers to bypass Fickling's primary static safety checks. This issue has been patched in version 0.1.7.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-184",
        "CWE-502"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22609.json"
}
References

Affected packages

Git / github.com/trailofbits/fickling

Affected ranges

Type
GIT
Repo
https://github.com/trailofbits/fickling
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
977b0769c13537cd96549c12bb537f05464cf09c

Affected versions

Other
master
v0.*
v0.0.1
v0.0.2
v0.0.3
v0.0.4
v0.0.5
v0.0.6
v0.0.7
v0.0.8
v0.1.0
v0.1.1
v0.1.2
v0.1.3
v0.1.4
v0.1.5
v0.1.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22609.json"