Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-m168-6jve-bqhw
Vulnerability ID VCID-m168-6jve-bqhw
Aliases CVE-2026-22607
GHSA-p523-jq9w-64x9
Summary Fickling is a Python pickling decompiler and static analyzer. Fickling versions up to and including 0.1.6 do not treat Python's cProfile module as unsafe. Because of this, a malicious pickle that uses cProfile.run() is classified as SUSPICIOUS instead of OVERTLY_MALICIOUS. If a user relies on Fickling's output to decide whether a pickle is safe to deserialize, this misclassification can lead them to execute attacker-controlled code on their system. This affects any workflow or product that uses Fickling as a security gate for pickle deserialization. This issue has been patched in version 0.1.7.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-184 Incomplete List of Disallowed Inputs
CWE-502 Deserialization of Untrusted Data
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2026-22607
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2026-22607
epss 0.00089 https://api.first.org/data/v1/epss?cve=CVE-2026-22607
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-p523-jq9w-64x9
cvssv4 8.9 https://github.com/trailofbits/fickling
generic_textual HIGH https://github.com/trailofbits/fickling
cvssv4 8.9 https://github.com/trailofbits/fickling/blob/977b0769c13537cd96549c12bb537f05464cf09c/test/test_bypasses.py#L116
generic_textual HIGH https://github.com/trailofbits/fickling/blob/977b0769c13537cd96549c12bb537f05464cf09c/test/test_bypasses.py#L116
cvssv4 8.9 https://github.com/trailofbits/fickling/commit/dc8ae12966edee27a78fe05c5745171a2b138d43
generic_textual HIGH https://github.com/trailofbits/fickling/commit/dc8ae12966edee27a78fe05c5745171a2b138d43
ssvc Track* https://github.com/trailofbits/fickling/commit/dc8ae12966edee27a78fe05c5745171a2b138d43
cvssv4 8.9 https://github.com/trailofbits/fickling/pull/108
generic_textual HIGH https://github.com/trailofbits/fickling/pull/108
cvssv4 8.9 https://github.com/trailofbits/fickling/pull/187
generic_textual HIGH https://github.com/trailofbits/fickling/pull/187
cvssv4 8.9 https://github.com/trailofbits/fickling/pull/195
generic_textual HIGH https://github.com/trailofbits/fickling/pull/195
cvssv4 8.9 https://github.com/trailofbits/fickling/releases/tag/v0.1.7
generic_textual HIGH https://github.com/trailofbits/fickling/releases/tag/v0.1.7
ssvc Track* https://github.com/trailofbits/fickling/releases/tag/v0.1.7
cvssv4 8.9 https://github.com/trailofbits/fickling/security/advisories/GHSA-565g-hwwr-4pp3
generic_textual HIGH https://github.com/trailofbits/fickling/security/advisories/GHSA-565g-hwwr-4pp3
cvssv3.1_qr HIGH https://github.com/trailofbits/fickling/security/advisories/GHSA-p523-jq9w-64x9
cvssv4 8.9 https://github.com/trailofbits/fickling/security/advisories/GHSA-p523-jq9w-64x9
generic_textual HIGH https://github.com/trailofbits/fickling/security/advisories/GHSA-p523-jq9w-64x9
ssvc Track* https://github.com/trailofbits/fickling/security/advisories/GHSA-p523-jq9w-64x9
cvssv4 8.9 https://github.com/trailofbits/fickling/security/advisories/GHSA-r7v6-mfhq-g3m2
generic_textual HIGH https://github.com/trailofbits/fickling/security/advisories/GHSA-r7v6-mfhq-g3m2
cvssv4 8.9 https://nvd.nist.gov/vuln/detail/CVE-2026-22607
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2026-22607
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-22607
https://github.com/trailofbits/fickling
https://github.com/trailofbits/fickling/blob/977b0769c13537cd96549c12bb537f05464cf09c/test/test_bypasses.py#L116
https://github.com/trailofbits/fickling/pull/195
CVE-2026-22607 https://nvd.nist.gov/vuln/detail/CVE-2026-22607
dc8ae12966edee27a78fe05c5745171a2b138d43 https://github.com/trailofbits/fickling/commit/dc8ae12966edee27a78fe05c5745171a2b138d43
GHSA-565g-hwwr-4pp3 https://github.com/trailofbits/fickling/security/advisories/GHSA-565g-hwwr-4pp3
GHSA-p523-jq9w-64x9 https://github.com/advisories/GHSA-p523-jq9w-64x9
GHSA-p523-jq9w-64x9 https://github.com/trailofbits/fickling/security/advisories/GHSA-p523-jq9w-64x9
GHSA-r7v6-mfhq-g3m2 https://github.com/trailofbits/fickling/security/advisories/GHSA-r7v6-mfhq-g3m2
v0.1.7 https://github.com/trailofbits/fickling/releases/tag/v0.1.7
No exploits are available.
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/trailofbits/fickling
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/trailofbits/fickling/blob/977b0769c13537cd96549c12bb537f05464cf09c/test/test_bypasses.py#L116
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/trailofbits/fickling/commit/dc8ae12966edee27a78fe05c5745171a2b138d43
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2026-01-13T21:49:35Z/ Found at https://github.com/trailofbits/fickling/commit/dc8ae12966edee27a78fe05c5745171a2b138d43
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/trailofbits/fickling/pull/108
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/trailofbits/fickling/pull/187
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/trailofbits/fickling/pull/195
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/trailofbits/fickling/releases/tag/v0.1.7
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2026-01-13T21:49:35Z/ Found at https://github.com/trailofbits/fickling/releases/tag/v0.1.7
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/trailofbits/fickling/security/advisories/GHSA-565g-hwwr-4pp3
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/trailofbits/fickling/security/advisories/GHSA-p523-jq9w-64x9
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2026-01-13T21:49:35Z/ Found at https://github.com/trailofbits/fickling/security/advisories/GHSA-p523-jq9w-64x9
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/trailofbits/fickling/security/advisories/GHSA-r7v6-mfhq-g3m2
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://nvd.nist.gov/vuln/detail/CVE-2026-22607
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.25392
EPSS Score 0.00089
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:52:44.840801+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/22xxx/CVE-2026-22607.json 38.6.0