Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
NVD Vulnerability Details :
CVE-2026-22609
Analyzed
More InfoOfficial Page
Source-security-advisories@github.com
View Known Exploited Vulnerability (KEV) details
Published At-10 Jan, 2026 | 02:15
Updated At-16 Jan, 2026 | 18:52

Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, the unsafe_imports() method in Fickling's static analyzer fails to flag several high-risk Python modules that can be used for arbitrary code execution. Malicious pickles importing these modules will not be detected as unsafe, allowing attackers to bypass Fickling's primary static safety checks. This issue has been patched in version 0.1.7.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary4.08.9HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary3.17.8HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Type: Secondary
Version: 4.0
Base score: 8.9
Base severity: HIGH
Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Type: Primary
Version: 3.1
Base score: 7.8
Base severity: HIGH
Vector:
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CPE Matches
trailofbits
trailofbits
>>fickling>>Versions before 0.1.7(exclusive)
cpe:2.3:a:trailofbits:fickling:*:*:*:*:*:python:*:*
Weaknesses
CWE IDTypeSource
CWE-184Secondarysecurity-advisories@github.com
CWE-502Secondarysecurity-advisories@github.com
CWE ID: CWE-184
Type: Secondary
Source: security-advisories@github.com
CWE ID: CWE-502
Type: Secondary
Source: security-advisories@github.com
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://github.com/trailofbits/fickling/commit/29d5545e74b07766892c1f0461b801afccee4f91security-advisories@github.com
Patch
https://github.com/trailofbits/fickling/commit/9a2b3f89bd0598b528d62c10a64c1986fcb09f66security-advisories@github.com
Patch
https://github.com/trailofbits/fickling/commit/b793563e60a5e039c5837b09d7f4f6b92e6040d1security-advisories@github.com
Patch
https://github.com/trailofbits/fickling/commit/eb299b453342f1931c787bcb3bc33f3a03a173f9security-advisories@github.com
Patch
https://github.com/trailofbits/fickling/releases/tag/v0.1.7security-advisories@github.com
Release Notes
https://github.com/trailofbits/fickling/security/advisories/GHSA-q5qq-mvfm-j35xsecurity-advisories@github.com
Exploit
Vendor Advisory
https://github.com/trailofbits/fickling/security/advisories/GHSA-q5qq-mvfm-j35x134c704f-9b21-4f2e-91b3-4a467353bcc0
Exploit
Vendor Advisory
Hyperlink: https://github.com/trailofbits/fickling/commit/29d5545e74b07766892c1f0461b801afccee4f91
Source: security-advisories@github.com
Resource:
Patch
Hyperlink: https://github.com/trailofbits/fickling/commit/9a2b3f89bd0598b528d62c10a64c1986fcb09f66
Source: security-advisories@github.com
Resource:
Patch
Hyperlink: https://github.com/trailofbits/fickling/commit/b793563e60a5e039c5837b09d7f4f6b92e6040d1
Source: security-advisories@github.com
Resource:
Patch
Hyperlink: https://github.com/trailofbits/fickling/commit/eb299b453342f1931c787bcb3bc33f3a03a173f9
Source: security-advisories@github.com
Resource:
Patch
Hyperlink: https://github.com/trailofbits/fickling/releases/tag/v0.1.7
Source: security-advisories@github.com
Resource:
Release Notes
Hyperlink: https://github.com/trailofbits/fickling/security/advisories/GHSA-q5qq-mvfm-j35x
Source: security-advisories@github.com
Resource:
Exploit
Vendor Advisory
Hyperlink: https://github.com/trailofbits/fickling/security/advisories/GHSA-q5qq-mvfm-j35x
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Resource:
Exploit
Vendor Advisory
Change History
0Changes found
Details not found