CVE-2026-22607: Fickling Python RCE Vulnerability

CVE-2026-22607 Overview

CVE-2026-22607 is an Insecure Deserialization vulnerability affecting Fickling, a Python pickling decompiler and static analyzer developed by Trail of Bits. The vulnerability exists in versions up to and including 0.1.6, where the tool fails to properly classify Python's cProfile module as unsafe during pickle analysis.

When analyzing potentially malicious pickle files, Fickling incorrectly classifies pickles that use cProfile.run() as SUSPICIOUS instead of OVERTLY_MALICIOUS. This misclassification creates a critical security gap for organizations and developers relying on Fickling as a security gate for pickle deserialization workflows, potentially leading to arbitrary code execution.

Critical Impact

Attackers can craft malicious pickle files that bypass Fickling's security analysis, enabling arbitrary code execution on systems that trust Fickling's classification output for deserialization decisions.

Affected Products

• Fickling versions 0.1.6 and earlier
• Any workflow or product using Fickling as a security gate for pickle deserialization
• Python applications relying on Fickling for malicious pickle detection

Discovery Timeline

• 2026-01-10 - CVE CVE-2026-22607 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2026-22607

Vulnerability Analysis

The vulnerability stems from an incomplete allowlist (CWE-184: Incomplete List of Disallowed Inputs) in Fickling's unsafe module detection logic. When analyzing pickle files for potentially dangerous operations, Fickling maintains a list of Python modules that should be flagged as overtly malicious when imported or called within a pickle.

The cProfile module, which is part of Python's standard library, provides a mechanism to execute arbitrary Python code through its run() function. This function accepts a string argument containing Python code and executes it with profiling enabled. An attacker can leverage this functionality within a malicious pickle to execute arbitrary commands while evading Fickling's security classification.

When a pickle contains cProfile.run() calls, Fickling versions prior to 0.1.7 would only flag the payload as SUSPICIOUS rather than OVERTLY_MALICIOUS. Users or automated systems that only block OVERTLY_MALICIOUS pickles would inadvertently allow these dangerous payloads to be deserialized and executed.

Root Cause

The root cause is an incomplete list of unsafe Python modules in Fickling's static analyzer. The cProfile module was not included in the set of modules that trigger an OVERTLY_MALICIOUS classification. This oversight allowed pickle payloads utilizing cProfile.run() to bypass the strictest security classification, despite the function being capable of executing arbitrary Python code.

Attack Vector

An attacker can exploit this vulnerability by crafting a malicious pickle file that leverages cProfile.run() to execute arbitrary code. The attack vector is network-based, as malicious pickles can be transmitted via API endpoints, file uploads, or any data exchange mechanism that accepts pickle-serialized data. The attack requires no authentication and can be executed without user interaction on systems that deserialize pickles based on Fickling's security assessment.

The attack workflow involves:

1. Creating a pickle payload that calls cProfile.run() with malicious Python code
2. Submitting the payload to a target system that uses Fickling for pre-deserialization security screening
3. Fickling analyzes the pickle and returns SUSPICIOUS instead of OVERTLY_MALICIOUS
4. The target system, trusting Fickling's assessment, deserializes the pickle
5. Arbitrary code execution occurs on the target system

The security patch adds cProfile to the list of unsafe imports in fickling/fickle.py:

                 "marshal",
                 "types",
                 "runpy",
+                "cProfile",
             ):
                 yield node
             elif "eval" in (n.name for n in node.names):

Source: GitHub Commit Changes

Detection Methods for CVE-2026-22607

Indicators of Compromise

• Pickle files containing references to cProfile module or cProfile.run() function calls
• Deserialization operations following Fickling analysis that returned SUSPICIOUS classification
• Unexpected process execution or system commands originating from Python pickle deserialization workflows
• Log entries showing Fickling classifying pickles as SUSPICIOUS when cProfile references are present

Detection Strategies

• Review Fickling analysis logs for SUSPICIOUS classifications and correlate with cProfile module usage
• Implement secondary scanning for any pickle flagged as SUSPICIOUS that contains cProfile references
• Monitor for cProfile.run() function calls during pickle deserialization operations
• Audit systems using Fickling versions prior to 0.1.7 as security gates

Monitoring Recommendations

• Enable detailed logging for all pickle deserialization operations in production systems
• Configure alerts for any pickle classified as SUSPICIOUS to trigger manual review
• Monitor Python process execution for unexpected cProfile module loading
• Implement runtime detection for code execution patterns associated with cProfile.run()

How to Mitigate CVE-2026-22607

Immediate Actions Required

• Upgrade Fickling to version 0.1.7 or later immediately
• Review all systems and workflows that use Fickling as a security gate for pickle deserialization
• Audit historical pickle files that were classified as SUSPICIOUS for potential cProfile exploitation
• Consider temporarily treating all SUSPICIOUS classifications as OVERTLY_MALICIOUS until the patch is applied

Patch Information

The vulnerability has been patched in Fickling version 0.1.7. The fix adds cProfile to the list of unsafe modules that trigger an OVERTLY_MALICIOUS classification when detected in pickle files.

Upgrade using pip:

pip install --upgrade fickling>=0.1.7

For detailed patch information, see the GitHub Security Advisory GHSA-p523-jq9w-64x9 and the GitHub Release v0.1.7.

Workarounds

• Treat all Fickling SUSPICIOUS classifications as potentially malicious until upgrade is complete
• Implement additional static analysis to detect cProfile module references in pickle files
• Avoid deserializing any untrusted pickle data regardless of Fickling's classification
• Consider sandboxed deserialization environments for pickle files from untrusted sources

# Verify Fickling version after upgrade
pip show fickling | grep Version
# Expected output: Version: 0.1.7 or higher

# Alternative: Pin Fickling version in requirements.txt
echo "fickling>=0.1.7" >> requirements.txt