Vulnerability · Published Jan 10, 2026 · Assigned by GitHub_M
CVE-2026-22612Fickling vulnerable to detection bypass due to "builtins" blindness
High 8.9
In plain English
A high-severity unsafe deserialization in fickling from trailofbits. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)8.9High
Exploit odds (30 days)0.3%top 74.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, Fickling is vulnerable to detection bypass due to "builtins" blindness. This issue has been patched in version 0.1.7.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | fickling | 0.1.7 | GHSA-h4rm-mm56-xf63 |
| PyPI | fickling | 0.1.7 | PYSEC-2026-1370 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| trailofbits | fickling | < 0.1.7 |
Weakness: CWE-502 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P