CVE-2026-22608

HIGH

Fickling <0.1.7 - RCE

Title source: llm
STIX 2.1

Description

Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, both ctypes and pydoc modules aren't explicitly blocked. Even other existing pickle scanning tools (like picklescan) do not block pydoc.locate. Chaining these two together can achieve RCE while the scanner still reports the file as LIKELY_SAFE. This issue has been patched in version 0.1.7.

Scores

CVSS v3 7.8
EPSS 0.0004
EPSS Percentile 12.8%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-184 CWE-502
Status published
Products (2)
pypi/fickling 0 - 0.1.7PyPI
trailofbits/fickling < 0.1.7
Published Jan 10, 2026
Tracked Since Feb 18, 2026