← Voltar para CVEs
CVE-2026-22609
HIGH7.8
Descricao
Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, the unsafe_imports() method in Fickling's static analyzer fails to flag several high-risk Python modules that can be used for arbitrary code execution. Malicious pickles importing these modules will not be detected as unsafe, allowing attackers to bypass Fickling's primary static safety checks. This issue has been patched in version 0.1.7.
Detalhes CVE
Pontuacao CVSS v3.17.8
SeveridadeHIGH
Vetor CVSSCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vetor de ataqueLOCAL
ComplexidadeLOW
Privilegios necessariosNONE
Interacao do usuarioREQUIRED
Publicado1/10/2026
Ultima modificacao1/16/2026
Fontenvd
Avistamentos honeypot0
Produtos afetados
trailofbits:fickling
Fraquezas (CWE)
CWE-184CWE-502
Referencias
https://github.com/trailofbits/fickling/commit/29d5545e74b07766892c1f0461b801afccee4f91(security-advisories@github.com)
https://github.com/trailofbits/fickling/commit/9a2b3f89bd0598b528d62c10a64c1986fcb09f66(security-advisories@github.com)
https://github.com/trailofbits/fickling/commit/b793563e60a5e039c5837b09d7f4f6b92e6040d1(security-advisories@github.com)
https://github.com/trailofbits/fickling/commit/eb299b453342f1931c787bcb3bc33f3a03a173f9(security-advisories@github.com)
https://github.com/trailofbits/fickling/releases/tag/v0.1.7(security-advisories@github.com)
https://github.com/trailofbits/fickling/security/advisories/GHSA-q5qq-mvfm-j35x(security-advisories@github.com)
https://github.com/trailofbits/fickling/security/advisories/GHSA-q5qq-mvfm-j35x(134c704f-9b21-4f2e-91b3-4a467353bcc0)
Correlacoes IOC
Sem correlacoes registradas
This product uses data from the NVD API but is not endorsed or certified by the NVD.