Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
NVD Vulnerability Details :
CVE-2026-22608
Analyzed
More InfoOfficial Page
Source-security-advisories@github.com
View Known Exploited Vulnerability (KEV) details
Published At-10 Jan, 2026 | 02:15
Updated At-16 Jan, 2026 | 18:57

Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, both ctypes and pydoc modules aren't explicitly blocked. Even other existing pickle scanning tools (like picklescan) do not block pydoc.locate. Chaining these two together can achieve RCE while the scanner still reports the file as LIKELY_SAFE. This issue has been patched in version 0.1.7.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary4.08.9HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary3.17.8HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Type: Secondary
Version: 4.0
Base score: 8.9
Base severity: HIGH
Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Type: Primary
Version: 3.1
Base score: 7.8
Base severity: HIGH
Vector:
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CPE Matches
trailofbits
trailofbits
>>fickling>>Versions before 0.1.7(exclusive)
cpe:2.3:a:trailofbits:fickling:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-184Secondarysecurity-advisories@github.com
CWE-502Secondarysecurity-advisories@github.com
CWE ID: CWE-184
Type: Secondary
Source: security-advisories@github.com
CWE ID: CWE-502
Type: Secondary
Source: security-advisories@github.com
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://github.com/trailofbits/fickling/commit/b793563e60a5e039c5837b09d7f4f6b92e6040d1security-advisories@github.com
Patch
https://github.com/trailofbits/fickling/releases/tag/v0.1.7security-advisories@github.com
Release Notes
https://github.com/trailofbits/fickling/security/advisories/GHSA-5hvc-6wx8-mvv4security-advisories@github.com
Vendor Advisory
https://github.com/trailofbits/fickling/security/advisories/GHSA-5hvc-6wx8-mvv4134c704f-9b21-4f2e-91b3-4a467353bcc0
Vendor Advisory
Hyperlink: https://github.com/trailofbits/fickling/commit/b793563e60a5e039c5837b09d7f4f6b92e6040d1
Source: security-advisories@github.com
Resource:
Patch
Hyperlink: https://github.com/trailofbits/fickling/releases/tag/v0.1.7
Source: security-advisories@github.com
Resource:
Release Notes
Hyperlink: https://github.com/trailofbits/fickling/security/advisories/GHSA-5hvc-6wx8-mvv4
Source: security-advisories@github.com
Resource:
Vendor Advisory
Hyperlink: https://github.com/trailofbits/fickling/security/advisories/GHSA-5hvc-6wx8-mvv4
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Resource:
Vendor Advisory
Change History
0Changes found
Details not found