CVE-2026-22607

Katalog CVE

CVSS 7.8 · High EPSS 0,52%

Kerentanan Incomplete List of Disallowed Inputs pada trailofbits fickling. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

Fickling is a Python pickling decompiler and static analyzer. Fickling versions up to and including 0.1.6 do not treat Python's cProfile module as unsafe. Because of this, a malicious pickle that uses cProfile.run() is classified as SUSPICIOUS instead of OVERTLY_MALICIOUS. If a user relies on Fickling's output to decide whether a pickle is safe to deserialize, this misclassification can lead them to execute attacker-controlled code on their system. This affects any workflow or product that uses Fickling as a security gate for pickle deserialization. This issue has been patched in version 0.1.7.

Rincian

Terbit di NVD

10 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-184: Incomplete List of Disallowed Inputs
CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/trailofbits/fickling/security/advisories/GHSA-p523-jq9w-64x9 exploit · advisory vendor
• https://github.com/trailofbits/fickling/commit/dc8ae12966edee27a78fe05c5745171a2b138d43 patch
• https://github.com/trailofbits/fickling/releases/tag/v0.1.7 release notes